Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
11/02/2024, 22:55
General
-
Target
RayzzCCGen.exe
-
Size
47KB
-
MD5
4e0b735658fa061371f03ac9d765acce
-
SHA1
298187f6e21045f4c2622b08f0b67ba2f554c163
-
SHA256
993e909e5060d07e3c21ca483b8dc2648bf50052124d300534f3885378aa7544
-
SHA512
7741da1d5e191a578bd4774255f112cb7bb52004f0ef0eeb66a12b6929add527dacb8c99efef71d834fbf3e6da4c11446a07b253f7d4ed8734ade415db34a137
-
SSDEEP
768:rM1TILIe8E+0YiyxDUiZc8YbNg6XaqN7AugGvEgK/J/ZVc6KN:rMrWRHzba+aqNMSnkJ/ZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
nabeellasdfasdf-52048.portmap.host:8080
nabeellasdfasdf-52048.portmap.host:52048
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
RAYZZCCGEN.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RayzzCCGen.exe"C:\Users\Admin\AppData\Local\Temp\RayzzCCGen.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RAYZZCCGEN" /tr '"C:\Users\Admin\AppData\Roaming\RAYZZCCGEN.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RAYZZCCGEN" /tr '"C:\Users\Admin\AppData\Roaming\RAYZZCCGEN.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D7D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\RAYZZCCGEN.exe"C:\Users\Admin\AppData\Roaming\RAYZZCCGEN.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5de75c43a265d0848584ae05945570edf
SHA169f95177914f8d8b2f278a91f585a0024b8dffd3
SHA256d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
SHA512365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
-
Filesize
154B
MD537920b99c49b5e4bed6e60fca1422cb0
SHA1d5201647fb5090f8659d7897463c96a94538885a
SHA256093712a7bfba4e5d596d31f06abf6ed01f39b9becb1251905880975c3f8e81ee
SHA512cada763d20131dd914afcbc8aaa316b2dc5e00f4285d2e8f37db9ddcd6f761411bae34b19e08fe0f86512081955f79528ef9813e9ab96e55a6895fb5d8033709
-
Filesize
47KB
MD54e0b735658fa061371f03ac9d765acce
SHA1298187f6e21045f4c2622b08f0b67ba2f554c163
SHA256993e909e5060d07e3c21ca483b8dc2648bf50052124d300534f3885378aa7544
SHA5127741da1d5e191a578bd4774255f112cb7bb52004f0ef0eeb66a12b6929add527dacb8c99efef71d834fbf3e6da4c11446a07b253f7d4ed8734ade415db34a137
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB