Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 13:34

General

  • Target

    344c9c0f72c535e334a4b605212c69d9.exe

  • Size

    1.7MB

  • MD5

    344c9c0f72c535e334a4b605212c69d9

  • SHA1

    952e1b506659a4113b2eb0857dbb86ee08e043a5

  • SHA256

    5664820279aa20d408c82998bff07ab34c0986124b09e9ef2025c73686c77f4f

  • SHA512

    a0e787755a38b2f3de72f17530b8ab6893db498c50a957df17ce16945b661e5daea648b3936267660a35478ac127a125a78c5f53099451e6950488198d204ba5

  • SSDEEP

    24576:ABOzHk9lBOQdkm5UfwauFL3WlrpY7Gv1eeajEja3KgffHCx2GwVT6ltVIaH3+j:AwyBmm5VXL3WZ7vcVjEvGHaKV2FJ3+j

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

139.84.229.159:2017

Mutex

jhT6lZT93vW5

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 29 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 29 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\344c9c0f72c535e334a4b605212c69d9.exe
    "C:\Users\Admin\AppData\Local\Temp\344c9c0f72c535e334a4b605212c69d9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AkaelkovO.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows "
        3⤵
          PID:3272
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
          3⤵
            PID:1032
          • C:\Windows\SysWOW64\xcopy.exe
            xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
            3⤵
            • Enumerates system info in registry
            PID:5024
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
            3⤵
              PID:3316
            • C:\Windows\SysWOW64\xcopy.exe
              xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
              3⤵
              • Enumerates system info in registry
              PID:4500
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
              3⤵
                PID:1764
              • C:\Windows\SysWOW64\xcopy.exe
                xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
                3⤵
                • Enumerates system info in registry
                PID:4064
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
                3⤵
                  PID:3112
                • C:\Windows\SysWOW64\xcopy.exe
                  xcopy "x.bat" "C:\Windows \System32\" /K /D /H /Y
                  3⤵
                  • Enumerates system info in registry
                  PID:4180
                • C:\Windows \System32\easinvoker.exe
                  "C:\\Windows \\System32\\easinvoker.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1596
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2496
                    • C:\Windows\system32\cmd.exe
                      cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1256
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2228
                    • C:\Windows\system32\sc.exe
                      sc.exe create truesight binPath="C:\Users\Public\Libraries\truesight.sys" type=kernel
                      5⤵
                      • Launches sc.exe
                      PID:3904
                    • C:\Windows\system32\sc.exe
                      sc.exe start truesight
                      5⤵
                      • Launches sc.exe
                      PID:2460
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c "C:\\Windows \\System32\\easinvoker.exe"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2524
                • C:\Windows \System32\easinvoker.exe
                  "C:\\Windows \\System32\\easinvoker.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1076
              • C:\Users\Public\Libraries\vokleakA.pif
                C:\Users\Public\Libraries\vokleakA.pif
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4896

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mabmo453.b0o.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Public\Libraries\AkaelkovO.bat

                    Filesize

                    404B

                    MD5

                    6880148d6cd8fabdce94b7e91dbd8d17

                    SHA1

                    870e9ad13355a8452746e0904d004ee8c8ec66e5

                    SHA256

                    0bfe311ffb1de96cbb2616c2a59c2a1a4942ec03073cc2ddfdfc43f79c74d18a

                    SHA512

                    810ee2896597cbcf813b9285bb2d7f9127360a4d8a872c47460d32710fe114c27ed58f840dc8bcfdaf7b826e7e46c78c0e814e4fa3d380d10737673a1febf38e

                  • C:\Users\Public\Libraries\KDECO.bat

                    Filesize

                    271B

                    MD5

                    d62b11dc4dc821ef23260e5b0e74a835

                    SHA1

                    cdff2004cb9ef149f75fae296f50f4fbfefb2e84

                    SHA256

                    d1b19b878a3ae98f650843314cc3ef8d681013f6e18e0201cb47a0afa45fc349

                    SHA512

                    27b8292eb318413b965e1c7552165e65f9003d03b15ddc0c5c142420a1a174303f983c268942d7b60c74ac4e8e79e01f83510807fc0c492cabdf4948bc69c625

                  • C:\Users\Public\Libraries\easinvoker.exe

                    Filesize

                    128KB

                    MD5

                    231ce1e1d7d98b44371ffff407d68b59

                    SHA1

                    25510d0f6353dbf0c9f72fc880de7585e34b28ff

                    SHA256

                    30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                    SHA512

                    520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                  • C:\Users\Public\Libraries\netutils.dll

                    Filesize

                    114KB

                    MD5

                    96b99e2a886d816c1b98b018adfe6311

                    SHA1

                    41f2f29bd8f366781ed1387068150eb2789dbbf8

                    SHA256

                    c300a049564eef6d8baa136858f1f6f0779003bd1b566d95689883c6935e2ba6

                    SHA512

                    6768632b586123b4b7c452c05b871a2474214a5d7db4a048f7b67bc2cda9dbf87c2efaf18bed86666dc145f948a2edbe3b01949fb75e6a68d813cd18a62ba45a

                  • C:\Users\Public\Libraries\vokleakA.pif

                    Filesize

                    171KB

                    MD5

                    22331abcc9472cc9dc6f37faf333aa2c

                    SHA1

                    2a001c30ba79a19ceaf6a09c3567c70311760aa4

                    SHA256

                    bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c

                    SHA512

                    c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c

                  • memory/1076-57-0x00000000613C0000-0x00000000613E2000-memory.dmp

                    Filesize

                    136KB

                  • memory/1596-28-0x00000000613C0000-0x00000000613E2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2228-40-0x000002841C0A0000-0x000002841C0C2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2228-42-0x0000028403500000-0x0000028403510000-memory.dmp

                    Filesize

                    64KB

                  • memory/2228-43-0x0000028403500000-0x0000028403510000-memory.dmp

                    Filesize

                    64KB

                  • memory/2228-46-0x00007FF8C0BC0000-0x00007FF8C1681000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/2228-41-0x0000028403500000-0x0000028403510000-memory.dmp

                    Filesize

                    64KB

                  • memory/2228-39-0x00007FF8C0BC0000-0x00007FF8C1681000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4264-0-0x00000000023B0000-0x00000000023B1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4264-1-0x0000000003FF0000-0x0000000004FF0000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4264-2-0x0000000003FF0000-0x0000000004FF0000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4264-4-0x0000000000400000-0x00000000005B3000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/4264-47-0x00000000023B0000-0x00000000023B1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4896-72-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-92-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-58-0x0000000000400000-0x0000000001400000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4896-60-0x0000000000400000-0x0000000001400000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4896-61-0x0000000075030000-0x00000000757E0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/4896-62-0x00000000285F0000-0x000000002864E000-memory.dmp

                    Filesize

                    376KB

                  • memory/4896-63-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-64-0x0000000028650000-0x0000000028BF4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4896-65-0x0000000028C40000-0x0000000028C9C000-memory.dmp

                    Filesize

                    368KB

                  • memory/4896-66-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-67-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-68-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-70-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-52-0x0000000000400000-0x0000000001400000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4896-74-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-76-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-78-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-80-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-82-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-84-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-86-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-88-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-90-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-56-0x0000000000400000-0x0000000001400000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4896-94-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-96-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-98-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-100-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-102-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-104-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-106-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-108-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-110-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-112-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-114-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-116-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-118-0x0000000028C40000-0x0000000028C97000-memory.dmp

                    Filesize

                    348KB

                  • memory/4896-1398-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-1399-0x0000000000400000-0x0000000001400000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/4896-1402-0x0000000029770000-0x000000002980C000-memory.dmp

                    Filesize

                    624KB

                  • memory/4896-1403-0x0000000029810000-0x0000000029876000-memory.dmp

                    Filesize

                    408KB

                  • memory/4896-1405-0x0000000075030000-0x00000000757E0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/4896-1406-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-1408-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-1409-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4896-1410-0x00000000260E0000-0x00000000260F0000-memory.dmp

                    Filesize

                    64KB