Analysis

  • max time kernel
    107s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 11:56

General

  • Target

    INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe

  • Size

    542KB

  • MD5

    0b97309812b9b2941e5512e12095960e

  • SHA1

    8fc625372ccea9b23c3c3585e1a86a06479eb630

  • SHA256

    1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381

  • SHA512

    8f0568c9cea86cd33c089ec6f9f32581563d03edbc5ab9a82fd83b81c57ecd4556248a58d40dd315732187a213218a5a4e0af458aec0bde4a6b647b906dfa65b

  • SSDEEP

    12288:eP7R2iNPBJI3AZp/UurrtqinZfTLatVX2wGlY:MV1xuAPH3A6natVX2wG

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

72.11.158.94:8808

Mutex

9Qbxs7iA1JpF

Attributes
  • delay

    3

  • install

    true

  • install_file

    vidextra.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
    "C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe
      "C:\Users\Admin\AppData\Local\Temp\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "vidextra" /tr '"C:\Users\Admin\AppData\Roaming\vidextra.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:4200
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC5C1.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:2052
        • C:\Users\Admin\AppData\Roaming\vidextra.exe
          "C:\Users\Admin\AppData\Roaming\vidextra.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:452
          • C:\Users\Admin\AppData\Roaming\vidextra.exe
            "C:\Users\Admin\AppData\Roaming\vidextra.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INQUIRYs#37567JAN2024NEWORDERMATERIALSPRODs.e.exe.log

          Filesize

          1KB

          MD5

          8ec831f3e3a3f77e4a7b9cd32b48384c

          SHA1

          d83f09fd87c5bd86e045873c231c14836e76a05c

          SHA256

          7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

          SHA512

          26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

        • C:\Users\Admin\AppData\Local\Temp\tmpC5C1.tmp.bat

          Filesize

          152B

          MD5

          ade8be5fd04f6088d9e878ad1f15cc98

          SHA1

          7311dbcb2df8ac0f4cec901751eda910778ca867

          SHA256

          e0670d09545c7cb1e57c4dfa3f875375310c8bcd6fc405a08671d973bea23e27

          SHA512

          83a5903ab7d8e00a782c70e933dc85b37365ad021809180f5b9794eda64c09166dd0505b6190440d92fcf94178a1c2aac88aedc03deb4e0dbd92ee83a2d2c0ed

        • C:\Users\Admin\AppData\Roaming\vidextra.exe

          Filesize

          542KB

          MD5

          0b97309812b9b2941e5512e12095960e

          SHA1

          8fc625372ccea9b23c3c3585e1a86a06479eb630

          SHA256

          1714faef50d0127645ce3540480623cf619f9b10c0364c67ca22db0f604e2381

          SHA512

          8f0568c9cea86cd33c089ec6f9f32581563d03edbc5ab9a82fd83b81c57ecd4556248a58d40dd315732187a213218a5a4e0af458aec0bde4a6b647b906dfa65b

        • memory/452-27-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/452-28-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

          Filesize

          64KB

        • memory/452-36-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/452-30-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

          Filesize

          64KB

        • memory/452-29-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1720-42-0x00000000057A0000-0x00000000057B0000-memory.dmp

          Filesize

          64KB

        • memory/1720-41-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1720-40-0x0000000005D60000-0x0000000005DC6000-memory.dmp

          Filesize

          408KB

        • memory/1720-37-0x00000000057A0000-0x00000000057B0000-memory.dmp

          Filesize

          64KB

        • memory/1720-35-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1864-10-0x0000000009E80000-0x0000000009F1C000-memory.dmp

          Filesize

          624KB

        • memory/1864-1-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1864-5-0x0000000004B90000-0x0000000004B9A000-memory.dmp

          Filesize

          40KB

        • memory/1864-17-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1864-6-0x0000000005170000-0x0000000005188000-memory.dmp

          Filesize

          96KB

        • memory/1864-3-0x0000000004C00000-0x0000000004C92000-memory.dmp

          Filesize

          584KB

        • memory/1864-2-0x00000000051B0000-0x0000000005754000-memory.dmp

          Filesize

          5.6MB

        • memory/1864-8-0x0000000005E80000-0x0000000005E8C000-memory.dmp

          Filesize

          48KB

        • memory/1864-0-0x0000000000140000-0x00000000001CC000-memory.dmp

          Filesize

          560KB

        • memory/1864-7-0x0000000005190000-0x0000000005198000-memory.dmp

          Filesize

          32KB

        • memory/1864-12-0x0000000004B20000-0x0000000004B30000-memory.dmp

          Filesize

          64KB

        • memory/1864-11-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1864-4-0x0000000004B20000-0x0000000004B30000-memory.dmp

          Filesize

          64KB

        • memory/1864-9-0x0000000006050000-0x000000000609C000-memory.dmp

          Filesize

          304KB

        • memory/2368-22-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/2368-13-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2368-18-0x00000000058D0000-0x00000000058E0000-memory.dmp

          Filesize

          64KB

        • memory/2368-16-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB