Analysis

  • max time kernel
    117s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2024, 14:52

General

  • Target

    invoice-INVR-2024012000.exe

  • Size

    429KB

  • MD5

    1ae050798555154c3c057598b0ccb3bf

  • SHA1

    d570386aa83a9264794b5f562bdd92ad40a845c9

  • SHA256

    923cf7d4a3785f11ac119a4a429a46fbcf1ff745d5865ce05efd9ef0a1ccef45

  • SHA512

    50d970b0a7612a19a0dce40be5595a707912b65ca767e88661fcf693287cdf1e75c2ca00c81fa1c7ec46ea775b12b2126300c4a5ad62212447f32d9bd48c9fcd

  • SSDEEP

    6144:4AMl3A4aHuEzu2pQ4lQPaQ7HnyHPMCQDw3RdoyPn3WSu9UxXVGYUML35q9k8Ljpn:LU3YlO4l4aQD2IEL7PGb9wl8Mid

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

203.20.113.158:6606

203.20.113.158:7707

203.20.113.158:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    microsotf.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 9 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe
    "C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cDTmbkDzaNG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cDTmbkDzaNG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D61.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2724
    • C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe
      "C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "microsotf" /tr '"C:\Users\Admin\AppData\Roaming\microsotf.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2352
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "microsotf" /tr '"C:\Users\Admin\AppData\Roaming\microsotf.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:2148
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA12F.tmp.bat""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:824
        • C:\Users\Admin\AppData\Roaming\microsotf.exe
          "C:\Users\Admin\AppData\Roaming\microsotf.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cDTmbkDzaNG.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2184
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cDTmbkDzaNG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE485.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:2044
          • C:\Users\Admin\AppData\Roaming\microsotf.exe
            "C:\Users\Admin\AppData\Roaming\microsotf.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1404

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabFC7A.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\tmp8D61.tmp

          Filesize

          1KB

          MD5

          004b45ca8dd8e6df86f86cfca513bd4a

          SHA1

          a318146459027397fe0fc51251f03d6a2f35c7a9

          SHA256

          dceb73d7849fa32c35fcf395a1c5711cac76abdcacf52683c5eb918f08e1dfdc

          SHA512

          4d37ba0d925b097a95825077d042eb909a6e7ce882224831926968335180174e739f3dc876a85c796fe2f4f47a598526c9b893a316150cb79f90ac7339dbb0a5

        • C:\Users\Admin\AppData\Local\Temp\tmpA12F.tmp.bat

          Filesize

          153B

          MD5

          3c9d65e5dc199618d0b2372a0e178505

          SHA1

          a1ac060b92989a2aec1045ee80538d5f6cc05ab4

          SHA256

          8a1b2bab7baa563ffca78e40891923765ef9cc4f9faa295b13c771b09660917b

          SHA512

          1a31925f069dcca2667849411af447687a6531871b11d0e901a03c5708887de3aafe29ebb295277dea45060e4b6636e87c4e4c232481be52c77560ec7acde817

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          d6d2b26b785bdab047befea2c1cd725e

          SHA1

          be7a132f3e04f24b57fc51666c3b3b88b2a37f90

          SHA256

          64adcdc6f0813fb5635ddea369c3fede6e3d7606d8d4da326b38499fbf42c88d

          SHA512

          f0468f81adf9e6bb4f64c15c14d3191f5b2bfefe7467e30c1dba8ee0028b022d11942dd59ac862a0a9efe4876c553defbf8e3bb0fade68c5786fa6e8e611d3d6

        • \Users\Admin\AppData\Roaming\microsotf.exe

          Filesize

          429KB

          MD5

          1ae050798555154c3c057598b0ccb3bf

          SHA1

          d570386aa83a9264794b5f562bdd92ad40a845c9

          SHA256

          923cf7d4a3785f11ac119a4a429a46fbcf1ff745d5865ce05efd9ef0a1ccef45

          SHA512

          50d970b0a7612a19a0dce40be5595a707912b65ca767e88661fcf693287cdf1e75c2ca00c81fa1c7ec46ea775b12b2126300c4a5ad62212447f32d9bd48c9fcd

        • memory/1404-75-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1404-78-0x00000000736C0000-0x0000000073DAE000-memory.dmp

          Filesize

          6.9MB

        • memory/1404-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1404-98-0x0000000004860000-0x00000000048A0000-memory.dmp

          Filesize

          256KB

        • memory/1404-97-0x00000000736C0000-0x0000000073DAE000-memory.dmp

          Filesize

          6.9MB

        • memory/1404-77-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1404-80-0x0000000004860000-0x00000000048A0000-memory.dmp

          Filesize

          256KB

        • memory/1740-0-0x0000000000180000-0x00000000001F2000-memory.dmp

          Filesize

          456KB

        • memory/1740-6-0x0000000002150000-0x000000000219C000-memory.dmp

          Filesize

          304KB

        • memory/1740-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp

          Filesize

          6.9MB

        • memory/1740-5-0x0000000000480000-0x000000000048C000-memory.dmp

          Filesize

          48KB

        • memory/1740-25-0x00000000747B0000-0x0000000074E9E000-memory.dmp

          Filesize

          6.9MB

        • memory/1740-4-0x0000000000470000-0x0000000000478000-memory.dmp

          Filesize

          32KB

        • memory/1740-2-0x00000000007F0000-0x0000000000830000-memory.dmp

          Filesize

          256KB

        • memory/1740-3-0x0000000000430000-0x0000000000448000-memory.dmp

          Filesize

          96KB

        • memory/1760-74-0x00000000740C0000-0x00000000747AE000-memory.dmp

          Filesize

          6.9MB

        • memory/1760-51-0x0000000004D90000-0x0000000004DD0000-memory.dmp

          Filesize

          256KB

        • memory/1760-50-0x00000000740C0000-0x00000000747AE000-memory.dmp

          Filesize

          6.9MB

        • memory/1760-49-0x00000000002D0000-0x0000000000342000-memory.dmp

          Filesize

          456KB

        • memory/2020-32-0x00000000023B0000-0x00000000023F0000-memory.dmp

          Filesize

          256KB

        • memory/2020-33-0x00000000023B0000-0x00000000023F0000-memory.dmp

          Filesize

          256KB

        • memory/2020-34-0x0000000072470000-0x0000000072A1B000-memory.dmp

          Filesize

          5.7MB

        • memory/2020-31-0x00000000023B0000-0x00000000023F0000-memory.dmp

          Filesize

          256KB

        • memory/2020-30-0x0000000072470000-0x0000000072A1B000-memory.dmp

          Filesize

          5.7MB

        • memory/2020-29-0x0000000072470000-0x0000000072A1B000-memory.dmp

          Filesize

          5.7MB

        • memory/2184-67-0x0000000002400000-0x0000000002440000-memory.dmp

          Filesize

          256KB

        • memory/2184-71-0x0000000002400000-0x0000000002440000-memory.dmp

          Filesize

          256KB

        • memory/2184-65-0x000000006F650000-0x000000006FBFB000-memory.dmp

          Filesize

          5.7MB

        • memory/2184-79-0x000000006F650000-0x000000006FBFB000-memory.dmp

          Filesize

          5.7MB

        • memory/2184-69-0x000000006F650000-0x000000006FBFB000-memory.dmp

          Filesize

          5.7MB

        • memory/2700-24-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-26-0x00000000747B0000-0x0000000074E9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2700-44-0x00000000747B0000-0x0000000074E9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2700-22-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-20-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2700-35-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

          Filesize

          256KB

        • memory/2700-16-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-15-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-14-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2700-12-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB