Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
73e51598d70df9f164408abaaf346211.exe
Resource
win7-20231129-en
General
-
Target
73e51598d70df9f164408abaaf346211.exe
-
Size
291KB
-
MD5
73e51598d70df9f164408abaaf346211
-
SHA1
31998d8ae54173f71c132120cf62fbda266a33fc
-
SHA256
238230eb6322dfb786b5e3054b44d1e0322aadfc44232111ec3db71e20503ee8
-
SHA512
4ef11892e99551ef08d596947edd3a4c6c936a22edbb9c25f9e59279b7bf8ea4cf5c4e51a0e98b7c2753a1180f762138290f77239e353bf57959e6cd074132e5
-
SSDEEP
3072:aFPdic8sB/RkDWMGdtFkZKm320SEuBJVJlACYpMHAsjyRhuKp4NS/wNBf+Dh8HiZ:QlxsmiKpBzJiPpMHAsehcNmm+DS4h
Malware Config
Extracted
asyncrat
0.5.6D
Default
79.134.225.44:7450
zesdluuiwc
-
delay
5
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1624-15-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 73e51598d70df9f164408abaaf346211.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1172 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 804 73e51598d70df9f164408abaaf346211.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 804 73e51598d70df9f164408abaaf346211.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 804 wrote to memory of 1172 804 73e51598d70df9f164408abaaf346211.exe 97 PID 804 wrote to memory of 1172 804 73e51598d70df9f164408abaaf346211.exe 97 PID 804 wrote to memory of 1172 804 73e51598d70df9f164408abaaf346211.exe 97 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99 PID 804 wrote to memory of 1624 804 73e51598d70df9f164408abaaf346211.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\73e51598d70df9f164408abaaf346211.exe"C:\Users\Admin\AppData\Local\Temp\73e51598d70df9f164408abaaf346211.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EzliZea" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp"2⤵
- Creates scheduled task(s)
PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\73e51598d70df9f164408abaaf346211.exe"{path}"2⤵PID:1624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\73e51598d70df9f164408abaaf346211.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD5698cd417636bf9d028fde264f43e0e63
SHA1b7462f95fd2d5ea786ff73ed0323c60a33c67ca8
SHA256eaced3f7fa33a6f5cfd35f11cf2dc9c4c936798c62e1ebbd343da535c6437528
SHA512eb0239725d7da045ebf66dbdcbce0e1ffbb95644ef63c43597c0a875dbb6f997e2959cc442617ea711b7224a45ad9744c55d70605f6beb689159ec2465679a05