Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 22:40
Static task
static1
Behavioral task
behavioral1
Sample
54c5be1e2056c9d591b7e35853ca4a84.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
54c5be1e2056c9d591b7e35853ca4a84.exe
Resource
win10v2004-20231215-en
General
-
Target
54c5be1e2056c9d591b7e35853ca4a84.exe
-
Size
585KB
-
MD5
54c5be1e2056c9d591b7e35853ca4a84
-
SHA1
c00bd4d0c3b6060dde5095c4c6938badf1b29eda
-
SHA256
0430110381976669226247e7c5403ac61f4d419c7fa223231ce5c9af7cd3bbf1
-
SHA512
8d6e219729f8a981c94b7e8d7b5f2bf764367b096381abaa3033171c590587b00ced309e641a9955f60c3836fc366c91bfd90414216373cd91e66ab2f24a4c75
-
SSDEEP
6144:5jrbYSqQ/Gq/lqLrBOOfd0tV9D8DT/XELB:5nb/xq0V9ATfWB
Malware Config
Extracted
asyncrat
0.5.7B
WIRE$$$$$$$$
severdops.ddns.net:6204
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
iconfx.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4460-7-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
54c5be1e2056c9d591b7e35853ca4a84.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 54c5be1e2056c9d591b7e35853ca4a84.exe -
Executes dropped EXE 2 IoCs
Processes:
iconfx.exeiconfx.exepid process 212 iconfx.exe 2480 iconfx.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
54c5be1e2056c9d591b7e35853ca4a84.exeiconfx.exedescription pid process target process PID 1868 set thread context of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 212 set thread context of 2480 212 iconfx.exe iconfx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4628 1868 WerFault.exe 54c5be1e2056c9d591b7e35853ca4a84.exe 4544 212 WerFault.exe iconfx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3252 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
54c5be1e2056c9d591b7e35853ca4a84.exepid process 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe 4460 54c5be1e2056c9d591b7e35853ca4a84.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
54c5be1e2056c9d591b7e35853ca4a84.exe54c5be1e2056c9d591b7e35853ca4a84.exeiconfx.exeiconfx.exedescription pid process Token: SeDebugPrivilege 1868 54c5be1e2056c9d591b7e35853ca4a84.exe Token: SeDebugPrivilege 4460 54c5be1e2056c9d591b7e35853ca4a84.exe Token: SeDebugPrivilege 212 iconfx.exe Token: SeDebugPrivilege 2480 iconfx.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
54c5be1e2056c9d591b7e35853ca4a84.exe54c5be1e2056c9d591b7e35853ca4a84.execmd.execmd.exeiconfx.exedescription pid process target process PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 1868 wrote to memory of 4460 1868 54c5be1e2056c9d591b7e35853ca4a84.exe 54c5be1e2056c9d591b7e35853ca4a84.exe PID 4460 wrote to memory of 4420 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4460 wrote to memory of 4420 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4460 wrote to memory of 4420 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4460 wrote to memory of 4256 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4460 wrote to memory of 4256 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4460 wrote to memory of 4256 4460 54c5be1e2056c9d591b7e35853ca4a84.exe cmd.exe PID 4420 wrote to memory of 4576 4420 cmd.exe schtasks.exe PID 4420 wrote to memory of 4576 4420 cmd.exe schtasks.exe PID 4420 wrote to memory of 4576 4420 cmd.exe schtasks.exe PID 4256 wrote to memory of 3252 4256 cmd.exe timeout.exe PID 4256 wrote to memory of 3252 4256 cmd.exe timeout.exe PID 4256 wrote to memory of 3252 4256 cmd.exe timeout.exe PID 4256 wrote to memory of 212 4256 cmd.exe iconfx.exe PID 4256 wrote to memory of 212 4256 cmd.exe iconfx.exe PID 4256 wrote to memory of 212 4256 cmd.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe PID 212 wrote to memory of 2480 212 iconfx.exe iconfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54c5be1e2056c9d591b7e35853ca4a84.exe"C:\Users\Admin\AppData\Local\Temp\54c5be1e2056c9d591b7e35853ca4a84.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54c5be1e2056c9d591b7e35853ca4a84.exe"C:\Users\Admin\AppData\Local\Temp\54c5be1e2056c9d591b7e35853ca4a84.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "iconfx" /tr '"C:\Users\Admin\AppData\Roaming\iconfx.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "iconfx" /tr '"C:\Users\Admin\AppData\Roaming\iconfx.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCA55.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\iconfx.exe"C:\Users\Admin\AppData\Roaming\iconfx.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 10925⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\iconfx.exe"C:\Users\Admin\AppData\Roaming\iconfx.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 10762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 212 -ip 2121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCA55.tmp.batFilesize
150B
MD50af051d6ca1db87f6ae60f09d16cb890
SHA11d0393fb6ca808211984daadbc8738979ee9a08b
SHA256a7dbd51ca771f54bd557c987c2f94810dad1aed8b17b57cbcaf599707c1a31a3
SHA512bb5075373e3aaeeab9c90c9e4fb6051c6677d8d4ff13831ad8e09e432733afe3cbc97ffdae430db1145f3cc6eace28f2b226cfe91063c96313fec7b3d83f4ea4
-
C:\Users\Admin\AppData\Roaming\iconfx.exeFilesize
92KB
MD561bfcc6a548d18847ea234a1682e34be
SHA1722e3be5062c5c8177916b946861378a08224522
SHA2565e4d8ad4636bc4d386f28c118c53c7c432fd4ced18113fd3614bc87bf3cf8399
SHA512b4adff2966a4c2753eb8a865d41579a58a41d7015e311c679218a758be72236bf177db5e1d3fe4b5a70b3a6530e3e652cbad99684f4abfe1813e9435646f4882
-
C:\Users\Admin\AppData\Roaming\iconfx.exeFilesize
95KB
MD5264d065f0366cb166a6cf4c043deafdf
SHA15ab83652b30c98a5d7d326de64e89942f09cf3d2
SHA256d8624e57d47994f4e776525ffc55a55316a88f7ac829d5b2ae1176d88ad0e0ef
SHA5127ef803a0359b95c2cbaf137c03d6b99f66d0d62d8a79c25e14d65710d0e5e35849a043f85fc576502166f22d9633720caf608ca11d8ffb83599e69aafe4cefbd
-
C:\Users\Admin\AppData\Roaming\iconfx.exeFilesize
585KB
MD554c5be1e2056c9d591b7e35853ca4a84
SHA1c00bd4d0c3b6060dde5095c4c6938badf1b29eda
SHA2560430110381976669226247e7c5403ac61f4d419c7fa223231ce5c9af7cd3bbf1
SHA5128d6e219729f8a981c94b7e8d7b5f2bf764367b096381abaa3033171c590587b00ced309e641a9955f60c3836fc366c91bfd90414216373cd91e66ab2f24a4c75
-
memory/212-30-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/212-25-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/212-24-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/1868-6-0x0000000004F90000-0x0000000004FA8000-memory.dmpFilesize
96KB
-
memory/1868-3-0x0000000004EF0000-0x0000000004F82000-memory.dmpFilesize
584KB
-
memory/1868-1-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/1868-11-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/1868-12-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/1868-8-0x0000000005000000-0x0000000005008000-memory.dmpFilesize
32KB
-
memory/1868-2-0x00000000055A0000-0x0000000005B44000-memory.dmpFilesize
5.6MB
-
memory/1868-4-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/1868-20-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/1868-0-0x0000000000470000-0x0000000000506000-memory.dmpFilesize
600KB
-
memory/1868-5-0x00000000050F0000-0x000000000518C000-memory.dmpFilesize
624KB
-
memory/2480-29-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/2480-31-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/2480-32-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/2480-33-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/4460-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4460-18-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB
-
memory/4460-13-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/4460-9-0x0000000074810000-0x0000000074FC0000-memory.dmpFilesize
7.7MB