Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2024, 12:45

General

  • Target

    01 NOTIFICACION DEMANDA.7z

  • Size

    1.8MB

  • MD5

    498acf51d16a7172a9a58ba29c66d706

  • SHA1

    244616a8aee45f52c461da8e7d9cf495c88645db

  • SHA256

    3caa7e5f3acd124de99d931f6044a67868e716235463ac7d5d6bd6be69aa48b5

  • SHA512

    e2a59b5aea09cb571b4b5c6b3b6e03536f8c334c108653b0ba388e0a1bc0d0ae7ea430a9968d8cc2b7e31771cb2bf6813e8dac5a782988e1d4874d82df911f3c

  • SSDEEP

    24576:Riyl5SoUORKhKgz2Sm/mye6IhA/xb9czSBoz/P2qzyyHilMpQ0dv0omvRcSEDthJ:YFhbzO+ye6II0uBgRGyHf2W9PicJTgU

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

mono2024.kozow.com:2727

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\01 NOTIFICACION DEMANDA.7z"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\01 NOTIFICACION DEMANDA.7z"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2196
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1088
    • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\01 NOTIFICACION DEMANDA .....exe
      "C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\01 NOTIFICACION DEMANDA .....exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:584

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\CabFB23.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\a5b503fc

            Filesize

            741KB

            MD5

            e9eed48f6c877fb405f0483f628aa1b2

            SHA1

            9a41ef5a964b8c6a35429b697f58ccc8f7808f72

            SHA256

            98a3969387d13b20a2c54391cb855648a609294679b5a586d9cd28216211c49d

            SHA512

            7dae7d57cc42299ff256eef7776964e872ed84f8799eb173b47e5a09bc03e3065411f185db468cae37c93814968072ffb34e8df000fc0b629110ac852436334a

          • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\01 NOTIFICACION DEMANDA .....exe

            Filesize

            135KB

            MD5

            a2d70fbab5181a509369d96b682fc641

            SHA1

            22afcdc180400c4d2b9e5a6db2b8a26bff54dd38

            SHA256

            8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473

            SHA512

            219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

          • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\breakage.ogg

            Filesize

            91KB

            MD5

            25ceb30a246b5e35393c3014a8458610

            SHA1

            30d174a20e735cd86458be23017a5e09ce46e85d

            SHA256

            23df8661729e5cd150bc5821f3a3d57d918332c4e34cca70eec6495fcb5582d1

            SHA512

            fe80bd336b87818c0e4091ad5d8c0c2a3ec167840072ead2c7533b20318360bc85b71d5b943973fb11018889e06c51042e0ecf7fe903f08487597e93970338ba

          • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\fascinator.psd

            Filesize

            517KB

            MD5

            41ed9f6378365fa37addbe5503911712

            SHA1

            8ef5324560d71fd78ec08bd6c7c15d8285f573ae

            SHA256

            43f2fb19d5d22b02465b8147d4dfff119bbdfa81feac91403827c2aa71c11175

            SHA512

            5c157a826c1373fc127ea521e515a382dd425aa586590dd15ada3e48f2542e2f425be504081305b2addec5e0470bda876cd0b522fb09ac0e1effb91ceb80dbc5

          • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\rtl120.bpl

            Filesize

            1.1MB

            MD5

            adf82ed333fb5567f8097c7235b0e17f

            SHA1

            e6ccaf016fc45edcdadeb40da64c207ddb33859f

            SHA256

            d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50

            SHA512

            2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

          • C:\Users\Admin\Downloads\01 NOTIFICACION DEMANDA\vcl120.bpl

            Filesize

            1.1MB

            MD5

            12d1ad41daeadcac4ff9335e7de438be

            SHA1

            950cdd8e143167eefc75070f8f31bab4cbc19858

            SHA256

            4661add2632c304b82d6c1140f6037663e58b077dd42ba36fcdf4e10d082f08a

            SHA512

            70503e980905065d036260188db677521d8b884485962c8a34567b5edcc11720ebe77adcac0608b69530f7ba247f05c1ec345a2e0117ff622e2329a3cd3aaad9

          • \Users\Admin\Downloads\01 NOTIFICACION DEMANDA\Register.dll

            Filesize

            1.0MB

            MD5

            dd001e7a2f751f6c9e8c40e23307d102

            SHA1

            22fdeab3d891334e2e27d970b3a5680d45cb3371

            SHA256

            e2b66236119bfea1571f423a721b1c4495b2363a0af83b8ec2ea728b4fdd7d7a

            SHA512

            ee9591e952028aab264ed6fa51369bb5c8d7aee4eaf735fd2f78b4559e2d07791d4d9777478d93be9de8952fa70105d9c431a48d380eebe637138fa188d7aae7

          • \Users\Admin\Downloads\01 NOTIFICACION DEMANDA\rtl120.bpl

            Filesize

            832KB

            MD5

            7bafa5953bb05ddd2c0ae92eb80cf6ea

            SHA1

            8eed04748bddf54f707aa5988670f647c5d745a9

            SHA256

            37c4ea59b22485d7c46aa64356d85821601c972c01f778ecc201b79ca5a9ba66

            SHA512

            5e3813e885ec60977333670384f39f309689ca7a6ec0d98b03efbe88da86b0e7f731933628171fd1510f407a150b175359ebe845a335222a78bef3980e477fa2

          • \Users\Admin\Downloads\01 NOTIFICACION DEMANDA\vcl120.bpl

            Filesize

            469KB

            MD5

            df684bd24b9960648777eeb9afec86fd

            SHA1

            27afb649f506f2bbdbc24be3b98537d16e611e44

            SHA256

            f8f1feb8fd8f9e1121cd9c18af0dc68dee97e6217b08e5b4e33a0ab6863f247a

            SHA512

            b13314b33f10322918a425873d9338d1c9551adc9c0caf94d532e3bcd86237a224aa62c663dab88dd2561748e0862df6e5a6e608e9d0a542d0f8215613f6ed17

          • memory/584-93-0x0000000072CF0000-0x0000000073D52000-memory.dmp

            Filesize

            16.4MB

          • memory/584-96-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/584-117-0x0000000004750000-0x0000000004790000-memory.dmp

            Filesize

            256KB

          • memory/584-116-0x00000000741A0000-0x000000007488E000-memory.dmp

            Filesize

            6.9MB

          • memory/584-99-0x0000000004750000-0x0000000004790000-memory.dmp

            Filesize

            256KB

          • memory/584-97-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/584-98-0x00000000741A0000-0x000000007488E000-memory.dmp

            Filesize

            6.9MB

          • memory/584-95-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/1364-63-0x00000000024A0000-0x00000000025AF000-memory.dmp

            Filesize

            1.1MB

          • memory/1364-58-0x0000000000400000-0x0000000000421000-memory.dmp

            Filesize

            132KB

          • memory/1364-55-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/1364-56-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/1364-59-0x0000000050000000-0x0000000050116000-memory.dmp

            Filesize

            1.1MB

          • memory/1364-45-0x00000000024A0000-0x00000000025AF000-memory.dmp

            Filesize

            1.1MB

          • memory/1364-42-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1364-48-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/1364-62-0x0000000050120000-0x000000005030D000-memory.dmp

            Filesize

            1.9MB

          • memory/1364-49-0x0000000077770000-0x0000000077919000-memory.dmp

            Filesize

            1.7MB

          • memory/2028-91-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/2028-61-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/2028-94-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/2028-90-0x0000000074B00000-0x0000000074C74000-memory.dmp

            Filesize

            1.5MB

          • memory/2028-64-0x0000000077770000-0x0000000077919000-memory.dmp

            Filesize

            1.7MB