Analysis Overview
SHA256
996b38a634ab861ffe4a65ad2b3657b45ffdbf06c595a45ab1acd5115538aab6
Threat Level: Known bad
The file 6d9b118979f1159246f3d37754ab0649 was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Async RAT payload
Checks computer location settings
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-21 17:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-21 17:27
Reported
2024-01-21 17:30
Platform
win7-20231129-en
Max time kernel
147s
Max time network
148s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1704 set thread context of 2480 | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe
"C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RNveAQv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD20E.tmp"
C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe
"C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | podzeye.duckdns.org | udp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | podzeye.duckdns.org | udp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
Files
memory/1704-0-0x0000000000D40000-0x0000000000DF2000-memory.dmp
memory/1704-1-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/1704-2-0x0000000000D00000-0x0000000000D40000-memory.dmp
memory/1704-3-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1704-4-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/1704-5-0x0000000000D00000-0x0000000000D40000-memory.dmp
memory/1704-6-0x0000000004F60000-0x0000000004FE4000-memory.dmp
memory/1704-7-0x0000000000580000-0x0000000000594000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpD20E.tmp
| MD5 | 7eafdde8e9c04fdb7131c7efb3486864 |
| SHA1 | 21ad676658e0228ffe29a46db1f4740b3e70b296 |
| SHA256 | 71f1ebb481418acb98265caccb37c936f2e71141d184e4ae09b76a7f3c171390 |
| SHA512 | b6cb5cb628ec8377c6060f82e04f2bb93237bf48ce64d5a5ff1e0a79befcf887c16f53537dd268addb32ceece576726cb2e60dd6066f551beb0d24d16fdc2e00 |
memory/2480-13-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-15-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-17-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-18-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2480-22-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-24-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-26-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2480-28-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/1704-27-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/2480-29-0x0000000000BD0000-0x0000000000C10000-memory.dmp
memory/2480-30-0x0000000074830000-0x0000000074F1E000-memory.dmp
memory/2480-31-0x0000000000BD0000-0x0000000000C10000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-21 17:27
Reported
2024-01-21 17:30
Platform
win10v2004-20231215-en
Max time kernel
150s
Max time network
149s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3464 set thread context of 2244 | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe
"C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RNveAQv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp"
C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe
"C:\Users\Admin\AppData\Local\Temp\6d9b118979f1159246f3d37754ab0649.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.178.17.96.in-addr.arpa | udp |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.1.37.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | podzeye.duckdns.org | udp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | 26.69.169.192.in-addr.arpa | udp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | 188.178.17.96.in-addr.arpa | udp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | 210.178.17.96.in-addr.arpa | udp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | podzeye.duckdns.org | udp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4442 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4433 | podzeye.duckdns.org | tcp |
| US | 192.169.69.26:4422 | podzeye.duckdns.org | tcp |
| US | 8.8.8.8:53 | 106.246.116.51.in-addr.arpa | udp |
| US | 192.169.69.26:4442 | tcp |
Files
memory/3464-0-0x0000000000DF0000-0x0000000000EA2000-memory.dmp
memory/3464-1-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/3464-2-0x0000000005870000-0x000000000590C000-memory.dmp
memory/3464-3-0x0000000005F80000-0x0000000006524000-memory.dmp
memory/3464-4-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/3464-5-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/3464-7-0x0000000005BA0000-0x0000000005BF6000-memory.dmp
memory/3464-6-0x0000000005940000-0x000000000594A000-memory.dmp
memory/3464-8-0x0000000005B80000-0x0000000005B92000-memory.dmp
memory/3464-9-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/3464-10-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/3464-11-0x00000000074C0000-0x0000000007544000-memory.dmp
memory/3464-12-0x0000000009B10000-0x0000000009B24000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp
| MD5 | 643030caa32ee9b557b8c556bd8572b9 |
| SHA1 | 185b8f8d55151681ac3f7ceda7e2ec7f2fda9e01 |
| SHA256 | 2d8a362f55054650b80810cfeba688e377d60a24c5e2417fd591f7bfb73acebf |
| SHA512 | 8f436213fa2c46b0f84b03d117a323a3f12312d5749c70dff8531a76b907eb35425973d3ae5b8616f9ce98e5aa74fbda438202edbd4ea70f1ce92dbef0dccf6d |
memory/2244-18-0x0000000000400000-0x0000000000412000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6d9b118979f1159246f3d37754ab0649.exe.log
| MD5 | 17573558c4e714f606f997e5157afaac |
| SHA1 | 13e16e9415ceef429aaf124139671ebeca09ed23 |
| SHA256 | c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553 |
| SHA512 | f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc |
memory/2244-21-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/3464-22-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/2244-23-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/2244-24-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/2244-25-0x0000000005AA0000-0x0000000005AB0000-memory.dmp