Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
de96f95692e27176b74125a40300ba08.exe
Resource
win7-20240215-en
General
-
Target
de96f95692e27176b74125a40300ba08.exe
-
Size
1.9MB
-
MD5
de96f95692e27176b74125a40300ba08
-
SHA1
472c7dfb79b00e95b68b3ba23c7fb5c14c740053
-
SHA256
172705adb5ebbb023174bafa12a8c572604258aaf4a3959ec6759c7e3333b7ec
-
SHA512
9062560007de212f285c1fee05df3b6cd021fcc4367d29b1baf9b0a1158aca484601a57b84e7c4b9c0937336f7a3e6e69fd990f516abd288666edf6aca16e1cc
-
SSDEEP
24576:sYYiCmMxAtOsBgo0q4wMcCcsp/iKgM4MRM/mXVK67k3GCo27nsISxZvBn2spMBuu:sVWsoHMcCbppx44lK13NAI6736F6Z
Malware Config
Extracted
asyncrat
0.5.7B
Default
podzeye.duckdns.org:4422
podzeye.duckdns.org:4442
podzeye.duckdns.org:4433
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/4508-8-0x0000000002770000-0x0000000002782000-memory.dmp CustAttr -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation de96f95692e27176b74125a40300ba08.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation System.exe -
Executes dropped EXE 2 IoCs
pid Process 2956 System.exe 4856 System.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4508 set thread context of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 2956 set thread context of 4856 2956 System.exe 115 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 408 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2956 System.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2956 System.exe Token: SeDebugPrivilege 4856 System.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4828 de96f95692e27176b74125a40300ba08.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4508 wrote to memory of 4828 4508 de96f95692e27176b74125a40300ba08.exe 104 PID 4828 wrote to memory of 2956 4828 de96f95692e27176b74125a40300ba08.exe 105 PID 4828 wrote to memory of 2956 4828 de96f95692e27176b74125a40300ba08.exe 105 PID 4828 wrote to memory of 2956 4828 de96f95692e27176b74125a40300ba08.exe 105 PID 2956 wrote to memory of 408 2956 System.exe 113 PID 2956 wrote to memory of 408 2956 System.exe 113 PID 2956 wrote to memory of 408 2956 System.exe 113 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115 PID 2956 wrote to memory of 4856 2956 System.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\de96f95692e27176b74125a40300ba08.exe"C:\Users\Admin\AppData\Local\Temp\de96f95692e27176b74125a40300ba08.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\de96f95692e27176b74125a40300ba08.exe"C:\Users\Admin\AppData\Local\Temp\de96f95692e27176b74125a40300ba08.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe" 03⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ToahHiZtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC7E.tmp"4⤵
- Creates scheduled task(s)
PID:408
-
-
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
Filesize
1.1MB
MD56de6f3b1c646ed699f7e31c0631d0032
SHA1e658e0ddf1d4d5cfbf3a73635ac96682bcfac6cb
SHA256eb054bd6d1a8270815b7aba891b45fad52593e1eb99dfb5052dadb61587e9c45
SHA51221eaa83a95ed1a4902ad06fe450a2fc745c5ebcb7816a9dd4690112910c83130b54a3632aa88ac498055ea33275e3df7373658053c0fbf5290ea3493273c566d
-
Filesize
1KB
MD50e0f8cf5cfaeb08a9fe4aaacb01be066
SHA1f005218824f0de9247186df7b6840a04b1d59c61
SHA25655437b302d0a1f34d1c3423558ba563763a79f8bd7f37d1f9e074b48a95a3f13
SHA51258c72919767211a6b3695ccd7db02cfb10774f61dd23dbbf8063d3d07bef0658cecf51159c756461c8d8551a5a7d316378327c7fec2438b2700e504e6476601d