Analysis

  • max time kernel
    105s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 04:13

General

  • Target

    4a68fda291581b91ef1b75893087dd08.exe

  • Size

    512KB

  • MD5

    4a68fda291581b91ef1b75893087dd08

  • SHA1

    4a53775d7b229a6641a8787ad95e78bd120059f9

  • SHA256

    86519701b3ca3206d80200bd34376b6a8571cc630fdc6812d7ed0adee8679b45

  • SHA512

    e2d2fb24042bdc05b713899c4d7446a3083fba4406b460c81caba6cb4d293712b86c6703e84ba3ad1770dee5fe22993d410979ba78422f2de614819cded456d1

  • SSDEEP

    12288:Uhsl2HqZov6n4zexn8ILg6qDwoMwIgtoHZ:UhsYioWxndwwHZ

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a68fda291581b91ef1b75893087dd08.exe
    "C:\Users\Admin\AppData\Local\Temp\4a68fda291581b91ef1b75893087dd08.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /tn OneDriveStandaloneAPIMethod /tr "C:\Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe" /st 04:19 /du 23:59 /sc daily /ri 1 /f
      2⤵
      • Creates scheduled task(s)
      PID:2380
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp.bat""
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\timeout.exe
        timeout 4
        3⤵
        • Delays execution with timeout.exe
        PID:2636
      • C:\Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:2596

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp.bat

          Filesize

          279B

          MD5

          cb35875d3d49c494749f608f47da1bf1

          SHA1

          9b4e639846585e18f4e2c05a5908c2715aa821cc

          SHA256

          574fe40c0b16f2a7d8d6443a8c5ff2041f4301c2dc38c77799a07b10f351acc2

          SHA512

          1609c69e4e0467352220195775dc950a485a0c96d01bf49367b3c212cca1ed6892874bc857b9012dbf520a3a0b606943835a0bc77f51acf7a247cd7ffdf82702

        • C:\Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe

          Filesize

          312KB

          MD5

          9bf60399eb6ada763a09879fe0e1ac0b

          SHA1

          55b70806e9351f717bd3c1db17de8cc3d53d9197

          SHA256

          441c8b2f9a3d9b3357842aee281987fae602ee1608f71636cf1e0631190bdb07

          SHA512

          ad54d64d8c516c6079ccf4eb5d6e860a1a73a30b55952990a6cc8117bd0847408db824edb3755d499880d50685ae568a3596ddc51ed2ad55c7a6c4978f5ceb9d

        • C:\Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe

          Filesize

          511KB

          MD5

          f2b7c86c43e9c59111495b8eb32b4814

          SHA1

          acd449da5b483e81085235d1bf241d91bc176f3c

          SHA256

          0624fda5f1c610ee12fd2283945ab37429a9d9231786e80a690cb34f015d0bba

          SHA512

          c2714080b8431eb748418cc90375c67726056559e909330718a830ac0aeb9a600cd309508ad3796b93119407a258600cbec993993ad6e5745fbec10167bc9d90

        • \Users\Admin\AppData\Roaming\Microsoft APIMethod\OneDriveStandaloneAPIMethod.exe

          Filesize

          205KB

          MD5

          5e164d85341071c0a70af45a457448db

          SHA1

          bf12ba1e64e15861f7f703ca5ab2479ffe61b87e

          SHA256

          787a33c6062ef21a4ba06781848e98de5851ca9466387ddefd93d194426a2b43

          SHA512

          59759db62bc8267530ff8912e831870ca5c034f197dc9ec7bde0eb75555730d688ca5488fd6e701ceca3675fa1efe8f41625baa24d0153295254f13b082b5ae9

        • memory/1656-17-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-5-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-6-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-7-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-8-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1656-9-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-10-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-11-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-12-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-13-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-14-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-15-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-16-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1656-18-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-19-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-20-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-21-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-22-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-23-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-24-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-25-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-26-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-27-0x0000000005150000-0x0000000005250000-memory.dmp

          Filesize

          1024KB

        • memory/1656-36-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-4-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-3-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/1656-0-0x0000000000BF0000-0x0000000000C76000-memory.dmp

          Filesize

          536KB

        • memory/1656-38-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1656-2-0x00000000046F0000-0x0000000004730000-memory.dmp

          Filesize

          256KB

        • memory/2596-45-0x0000000004C40000-0x0000000004C80000-memory.dmp

          Filesize

          256KB

        • memory/2596-59-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-52-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-43-0x0000000000F60000-0x0000000000FE6000-memory.dmp

          Filesize

          536KB

        • memory/2596-46-0x0000000004C40000-0x0000000004C80000-memory.dmp

          Filesize

          256KB

        • memory/2596-47-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-48-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-49-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-50-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-51-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-44-0x0000000004C40000-0x0000000004C80000-memory.dmp

          Filesize

          256KB

        • memory/2596-53-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-55-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-54-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2596-56-0x0000000004C40000-0x0000000004C80000-memory.dmp

          Filesize

          256KB

        • memory/2596-57-0x0000000004C40000-0x0000000004C80000-memory.dmp

          Filesize

          256KB

        • memory/2596-58-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-42-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2596-60-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-61-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-62-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-63-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-64-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-65-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-67-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-66-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-69-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-68-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-71-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-70-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-72-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-73-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-75-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB

        • memory/2596-74-0x00000000053D0000-0x00000000054D0000-memory.dmp

          Filesize

          1024KB