Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 14:52

General

  • Target

    invoice-INVR-2024012000.exe

  • Size

    429KB

  • MD5

    1ae050798555154c3c057598b0ccb3bf

  • SHA1

    d570386aa83a9264794b5f562bdd92ad40a845c9

  • SHA256

    923cf7d4a3785f11ac119a4a429a46fbcf1ff745d5865ce05efd9ef0a1ccef45

  • SHA512

    50d970b0a7612a19a0dce40be5595a707912b65ca767e88661fcf693287cdf1e75c2ca00c81fa1c7ec46ea775b12b2126300c4a5ad62212447f32d9bd48c9fcd

  • SSDEEP

    6144:4AMl3A4aHuEzu2pQ4lQPaQ7HnyHPMCQDw3RdoyPn3WSu9UxXVGYUML35q9k8Ljpn:LU3YlO4l4aQD2IEL7PGb9wl8Mid

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

203.20.113.158:6606

203.20.113.158:7707

203.20.113.158:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    microsotf.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe
    "C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cDTmbkDzaNG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cDTmbkDzaNG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8453.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1548
    • C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe
      "C:\Users\Admin\AppData\Local\Temp\invoice-INVR-2024012000.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp93E3.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:3548
        • C:\Users\Admin\AppData\Roaming\microsotf.exe
          "C:\Users\Admin\AppData\Roaming\microsotf.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cDTmbkDzaNG.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3456
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cDTmbkDzaNG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD755.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:1816
          • C:\Users\Admin\AppData\Roaming\microsotf.exe
            "C:\Users\Admin\AppData\Roaming\microsotf.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4992
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "microsotf" /tr '"C:\Users\Admin\AppData\Roaming\microsotf.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "microsotf" /tr '"C:\Users\Admin\AppData\Roaming\microsotf.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:5108

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice-INVR-2024012000.exe.log

          Filesize

          1KB

          MD5

          8ec831f3e3a3f77e4a7b9cd32b48384c

          SHA1

          d83f09fd87c5bd86e045873c231c14836e76a05c

          SHA256

          7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

          SHA512

          26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          d86ca6a6596435e126a7bb908248682f

          SHA1

          dcf052cf2918e0c47d0ec05e75319cb77ab82681

          SHA256

          43f50ddad44bfa778c9900ab7db6c97ecfe195d7d13a31955e3f730112889206

          SHA512

          db385bc4a476f7ee3761661f34eed1d07785863f8f1c508c26c7613bb66f5fb4b4d86c43e5d32f952051394eaf49b15812272b161e45e1121915eabc532a9830

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gi02sxzc.o0j.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp8453.tmp

          Filesize

          1KB

          MD5

          dfc637ba13d0455db4203f555d307918

          SHA1

          e220bbe82521fba12a4020a405df2bd895cc31ef

          SHA256

          82031e208a1e9dbac2754b565eb1f1417594e7c52131463e1744320ee591481c

          SHA512

          d996f101ea2516c7c1bd6fd39bb685cdbc137ca5d4e7ae3fecd6c3a098a3ffb9ebeeb56105332f668f53dc034f05a634413cac10469003f7f3292434ad723cde

        • C:\Users\Admin\AppData\Local\Temp\tmp93E3.tmp.bat

          Filesize

          153B

          MD5

          53d2ddb3c230a473e76ac6ad2717e15b

          SHA1

          643bc4acf43744438bc889935d98cef4d58dbe79

          SHA256

          e529028725cbaeb574e1e89e93f043f572afd4611885994dc445d9dbbc43c465

          SHA512

          7b42bf10d30ee7c8ebb72516d7091b28da5a266b127c2e7e90090abc01b6eeb56c49490bf1dc7c205698b65255d218c748f8abad21f97d71cda034ef72729c59

        • C:\Users\Admin\AppData\Roaming\microsotf.exe

          Filesize

          429KB

          MD5

          1ae050798555154c3c057598b0ccb3bf

          SHA1

          d570386aa83a9264794b5f562bdd92ad40a845c9

          SHA256

          923cf7d4a3785f11ac119a4a429a46fbcf1ff745d5865ce05efd9ef0a1ccef45

          SHA512

          50d970b0a7612a19a0dce40be5595a707912b65ca767e88661fcf693287cdf1e75c2ca00c81fa1c7ec46ea775b12b2126300c4a5ad62212447f32d9bd48c9fcd

        • C:\Users\Admin\AppData\Roaming\microsotf.exe

          Filesize

          314KB

          MD5

          33ddcd65b290809414bec9e792887c85

          SHA1

          0b1bbf97f4c08d5bf6d31cf7000a557e7ff49310

          SHA256

          90b165cf1b787cb4c1bd79ea4d85663dc80b33355463d45c9d211ba9951ac1f9

          SHA512

          951180eee07478c57251bdc3af3de931ecc2e14815d665c98a8e6e520aca48156124e3c86b2e1c8362e31bfd04ac606bcc29356bb97cf72ba759bd2b13ab7cae

        • C:\Users\Admin\AppData\Roaming\microsotf.exe

          Filesize

          360KB

          MD5

          29651ff5cfd6e1b36dbb53b9a754fb03

          SHA1

          c5b1fa4b9dac302304ae50936bbfa8ff6350f6e5

          SHA256

          bfa3c820f8075c3424e100abd38047ac7269559a37830675176c2b93a17f40c4

          SHA512

          1170906030aea24aa03506b29725ce5049a26f0e074928f8b0035814e6c45a4ce2672ad388c0d0f5fb35849dd01549f18b43891330e815bb215803d6e0e72d1a

        • memory/948-61-0x00000000079F0000-0x0000000007A01000-memory.dmp

          Filesize

          68KB

        • memory/948-27-0x0000000005E10000-0x0000000005E76000-memory.dmp

          Filesize

          408KB

        • memory/948-15-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

          Filesize

          216KB

        • memory/948-16-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/948-17-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/948-65-0x0000000007B10000-0x0000000007B18000-memory.dmp

          Filesize

          32KB

        • memory/948-18-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/948-63-0x0000000007A30000-0x0000000007A44000-memory.dmp

          Filesize

          80KB

        • memory/948-62-0x0000000007A20000-0x0000000007A2E000-memory.dmp

          Filesize

          56KB

        • memory/948-59-0x0000000007860000-0x000000000786A000-memory.dmp

          Filesize

          40KB

        • memory/948-20-0x0000000005600000-0x0000000005C28000-memory.dmp

          Filesize

          6.2MB

        • memory/948-60-0x0000000007A70000-0x0000000007B06000-memory.dmp

          Filesize

          600KB

        • memory/948-25-0x0000000005510000-0x0000000005532000-memory.dmp

          Filesize

          136KB

        • memory/948-64-0x0000000007B30000-0x0000000007B4A000-memory.dmp

          Filesize

          104KB

        • memory/948-68-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/948-29-0x0000000005E80000-0x0000000005EE6000-memory.dmp

          Filesize

          408KB

        • memory/948-38-0x0000000005FF0000-0x0000000006344000-memory.dmp

          Filesize

          3.3MB

        • memory/948-39-0x00000000064C0000-0x00000000064DE000-memory.dmp

          Filesize

          120KB

        • memory/948-40-0x0000000006500000-0x000000000654C000-memory.dmp

          Filesize

          304KB

        • memory/948-43-0x0000000070E40000-0x0000000070E8C000-memory.dmp

          Filesize

          304KB

        • memory/948-42-0x0000000006A90000-0x0000000006AC2000-memory.dmp

          Filesize

          200KB

        • memory/948-54-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/948-53-0x00000000076A0000-0x00000000076BE000-memory.dmp

          Filesize

          120KB

        • memory/948-56-0x00000000076C0000-0x0000000007763000-memory.dmp

          Filesize

          652KB

        • memory/948-55-0x0000000002C40000-0x0000000002C50000-memory.dmp

          Filesize

          64KB

        • memory/948-41-0x000000007FA60000-0x000000007FA70000-memory.dmp

          Filesize

          64KB

        • memory/948-58-0x00000000077F0000-0x000000000780A000-memory.dmp

          Filesize

          104KB

        • memory/948-57-0x0000000007E30000-0x00000000084AA000-memory.dmp

          Filesize

          6.5MB

        • memory/3456-83-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/3456-103-0x000000007FA80000-0x000000007FA90000-memory.dmp

          Filesize

          64KB

        • memory/3456-120-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/3456-118-0x0000000007C50000-0x0000000007C64000-memory.dmp

          Filesize

          80KB

        • memory/3456-117-0x0000000007C20000-0x0000000007C31000-memory.dmp

          Filesize

          68KB

        • memory/3456-114-0x0000000007960000-0x0000000007A03000-memory.dmp

          Filesize

          652KB

        • memory/3456-115-0x0000000001480000-0x0000000001490000-memory.dmp

          Filesize

          64KB

        • memory/3456-116-0x0000000001480000-0x0000000001490000-memory.dmp

          Filesize

          64KB

        • memory/3456-104-0x0000000074E70000-0x0000000074EBC000-memory.dmp

          Filesize

          304KB

        • memory/3456-102-0x0000000006C50000-0x0000000006C9C000-memory.dmp

          Filesize

          304KB

        • memory/3456-100-0x00000000060F0000-0x0000000006444000-memory.dmp

          Filesize

          3.3MB

        • memory/3456-87-0x0000000001480000-0x0000000001490000-memory.dmp

          Filesize

          64KB

        • memory/3456-85-0x0000000001480000-0x0000000001490000-memory.dmp

          Filesize

          64KB

        • memory/3500-21-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/3500-69-0x0000000005180000-0x0000000005190000-memory.dmp

          Filesize

          64KB

        • memory/3500-26-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/3500-73-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4356-90-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4356-79-0x00000000027F0000-0x0000000002800000-memory.dmp

          Filesize

          64KB

        • memory/4356-78-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4436-1-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4436-7-0x0000000005B70000-0x0000000005B78000-memory.dmp

          Filesize

          32KB

        • memory/4436-6-0x00000000035B0000-0x00000000035C8000-memory.dmp

          Filesize

          96KB

        • memory/4436-5-0x0000000003500000-0x000000000350A000-memory.dmp

          Filesize

          40KB

        • memory/4436-2-0x0000000005ED0000-0x0000000006474000-memory.dmp

          Filesize

          5.6MB

        • memory/4436-4-0x0000000005B50000-0x0000000005B60000-memory.dmp

          Filesize

          64KB

        • memory/4436-0-0x0000000000E10000-0x0000000000E82000-memory.dmp

          Filesize

          456KB

        • memory/4436-3-0x0000000005920000-0x00000000059B2000-memory.dmp

          Filesize

          584KB

        • memory/4436-8-0x0000000005BA0000-0x0000000005BAC000-memory.dmp

          Filesize

          48KB

        • memory/4436-9-0x0000000007DE0000-0x0000000007E2C000-memory.dmp

          Filesize

          304KB

        • memory/4436-10-0x000000000A590000-0x000000000A62C000-memory.dmp

          Filesize

          624KB

        • memory/4436-24-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-89-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-121-0x00000000051D0000-0x00000000051E0000-memory.dmp

          Filesize

          64KB

        • memory/4992-124-0x0000000074580000-0x0000000074D30000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-125-0x00000000051D0000-0x00000000051E0000-memory.dmp

          Filesize

          64KB