Analysis
- max time kernel
145s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/03/2024, 21:45
General
- Target 002 NOTIFICACION DEMANDA/002 NOTIFICACION DEMANDA.exe
- Size 446KB
- Sample240312-1mcjaabd5y
- SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
Malware Config
Extracted
-
asyncrat
-
| CRACKED BY https://t.me/xworm_v2
-
Default
-
bollon8.kozow.com:6969
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\002 NOTIFICACION DEMANDA\002 NOTIFICACION DEMANDA.exe"C:\Users\Admin\AppData\Local\Temp\002 NOTIFICACION DEMANDA\002 NOTIFICACION DEMANDA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
16788da2
memory/1044-12-0x00007FF99DCF0000-0x00007FF99DEE5000-memory.dmp
memory/1044-17-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/1044-15-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/1044-14-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/1044-10-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/2456-18-0x0000000073000000-0x0000000074254000-memory.dmp
memory/2456-26-0x0000000005180000-0x000000000518A000-memory.dmp
memory/2456-32-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2456-31-0x0000000072850000-0x0000000073000000-memory.dmp
memory/2456-30-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/2456-21-0x0000000072850000-0x0000000073000000-memory.dmp
memory/2456-22-0x0000000000390000-0x00000000003A6000-memory.dmp
memory/2456-23-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2456-24-0x0000000005540000-0x0000000005AE4000-memory.dmp
memory/2456-25-0x0000000005190000-0x0000000005222000-memory.dmp
memory/2456-29-0x00000000060D0000-0x000000000616C000-memory.dmp
memory/4204-8-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/4204-0-0x0000000074B70000-0x0000000074CEB000-memory.dmp
memory/4204-1-0x00007FF99DCF0000-0x00007FF99DEE5000-memory.dmp
memory/4204-7-0x0000000074B70000-0x0000000074CEB000-memory.dmp