Analysis
- max time kernel
161s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
08/01/2024, 03:48
General
- Target 33b845f4977885ba03d8de6bc260847dd0ec6dc9489a2da3071701b160a1ddec.exe
- Size 331KB
- Sample240108-ec8cbaaehj
- SHA256 33b845f4977885ba03d8de6bc260847dd0ec6dc9489a2da3071701b160a1ddec
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
https://api.telegram.org/bot6342313307:AAFKd4P2Qn-FrHlxYQr9imHCnOVc5Cl4eMI/sendMessage?chat_id=1059970907
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect ZGRat V1 1 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 3 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Async RAT payload 3 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b845f4977885ba03d8de6bc260847dd0ec6dc9489a2da3071701b160a1ddec.exe"C:\Users\Admin\AppData\Local\Temp\33b845f4977885ba03d8de6bc260847dd0ec6dc9489a2da3071701b160a1ddec.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\POWERSHELL.exe"POWERSHELL" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
WindowsCache124526tgc842aze.bin
__PSScriptPolicyTest_mlgzcv22.4qv.ps1
memory/912-99-0x00000000082A0000-0x00000000082D0000-memory.dmp
memory/912-80-0x00000000096A0000-0x00000000096B1000-memory.dmp
memory/912-100-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-76-0x0000000009650000-0x000000000965A000-memory.dmp
memory/912-98-0x0000000005750000-0x0000000005783000-memory.dmp
memory/912-4-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-96-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-95-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-3-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/912-2-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-1-0x0000000000670000-0x00000000006CA000-memory.dmp
memory/912-85-0x0000000009DE0000-0x0000000009DFA000-memory.dmp
memory/912-84-0x0000000009660000-0x000000000966E000-memory.dmp
memory/912-101-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-43-0x0000000005D80000-0x0000000005D9A000-memory.dmp
memory/912-44-0x0000000006C70000-0x00000000072EA000-memory.dmp
memory/912-45-0x0000000005EC0000-0x0000000005F56000-memory.dmp
memory/912-79-0x00000000FF2C0000-0x00000000FF2D0000-memory.dmp
memory/912-47-0x0000000005E50000-0x0000000005E72000-memory.dmp
memory/912-48-0x00000000078A0000-0x0000000007E44000-memory.dmp
memory/912-49-0x00000000066D0000-0x000000000671A000-memory.dmp
memory/912-0-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/912-51-0x00000000FF2C0000-0x00000000FF2D0000-memory.dmp
memory/912-78-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/912-62-0x0000000008FD0000-0x0000000008FEE000-memory.dmp
memory/4344-50-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4344-64-0x0000000070210000-0x000000007025C000-memory.dmp
memory/4344-75-0x00000000076F0000-0x0000000007793000-memory.dmp
memory/4344-63-0x0000000006CA0000-0x0000000006CD2000-memory.dmp
memory/4344-77-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4344-61-0x000000007F920000-0x000000007F930000-memory.dmp
memory/4344-46-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4344-34-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4344-81-0x000000007F920000-0x000000007F930000-memory.dmp
memory/4344-82-0x0000000001080000-0x000000000108E000-memory.dmp
memory/4344-83-0x0000000007C10000-0x0000000007C24000-memory.dmp
memory/4344-27-0x0000000006750000-0x000000000679C000-memory.dmp
memory/4344-26-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4344-86-0x0000000007C50000-0x0000000007C6A000-memory.dmp
memory/4344-87-0x0000000007AB0000-0x0000000007AB8000-memory.dmp
memory/4344-25-0x0000000006680000-0x000000000669E000-memory.dmp
memory/4344-17-0x00000000060B0000-0x0000000006404000-memory.dmp
memory/4344-94-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4344-11-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/4344-10-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/4344-9-0x00000000056E0000-0x0000000005702000-memory.dmp
memory/4344-8-0x00000000059F0000-0x0000000006018000-memory.dmp
memory/4344-7-0x0000000002D50000-0x0000000002D86000-memory.dmp
memory/4344-6-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4344-5-0x00000000747A0000-0x0000000074F50000-memory.dmp