Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 11:27
Behavioral task
behavioral1
Sample
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
Resource
win10v2004-20240226-en
General
-
Target
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
-
Size
63KB
-
MD5
c1ade258f05c512e98ebc4d9d1165f8a
-
SHA1
acf20f6a7dc7841ae06f801b887289fdc99e0488
-
SHA256
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759
-
SHA512
5b652e0ef6293d7baeb7e9d8b79322ec65e98d748e1df492099fa6692d0bbc78f032df68e7028a28af06b5c27394456159351a6469fdaf777e6eb98609331076
-
SSDEEP
1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Exodus_Market
leetboy.dynuddns.net:1339
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
svchos.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x000b000000023024-12.dat family_asyncrat behavioral2/memory/3428-14-0x0000000000920000-0x0000000000930000-memory.dmp family_asyncrat behavioral2/memory/3428-19-0x0000000000920000-0x0000000000930000-memory.dmp family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe -
Executes dropped EXE 1 IoCs
pid Process 3428 svchos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 624 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1196 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3428 svchos.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe Token: SeDebugPrivilege 3428 svchos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3428 svchos.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3916 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 93 PID 3176 wrote to memory of 3916 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 93 PID 3176 wrote to memory of 3916 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 93 PID 3176 wrote to memory of 2204 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 95 PID 3176 wrote to memory of 2204 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 95 PID 3176 wrote to memory of 2204 3176 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 95 PID 2204 wrote to memory of 1196 2204 cmd.exe 97 PID 2204 wrote to memory of 1196 2204 cmd.exe 97 PID 2204 wrote to memory of 1196 2204 cmd.exe 97 PID 3916 wrote to memory of 624 3916 cmd.exe 98 PID 3916 wrote to memory of 624 3916 cmd.exe 98 PID 3916 wrote to memory of 624 3916 cmd.exe 98 PID 2204 wrote to memory of 3428 2204 cmd.exe 100 PID 2204 wrote to memory of 3428 2204 cmd.exe 100 PID 2204 wrote to memory of 3428 2204 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe"C:\Users\Admin\AppData\Local\Temp\447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"'3⤵
- Creates scheduled task(s)
PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp42E5.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1196
-
-
C:\Users\Admin\AppData\Roaming\svchos.exe"C:\Users\Admin\AppData\Roaming\svchos.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD5ecdc16c0a2869c185de63ddf163f264a
SHA145a548f97abd016b1fdb7f1086029ccc6cc74a8b
SHA2568bee01464cfdb8b2524fcf30f4cf3fe3a09b9cd409387b0c121862654b9de98c
SHA5125164b7c7865c7f72f8f1ad7dd97f4ec5cb95be47f07d34b11739420853010b79096c1e5c6e9f8b1147328f16bbfba805cbee097af376a5dc3c0173ee2d97cc07
-
Filesize
63KB
MD5c1ade258f05c512e98ebc4d9d1165f8a
SHA1acf20f6a7dc7841ae06f801b887289fdc99e0488
SHA256447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759
SHA5125b652e0ef6293d7baeb7e9d8b79322ec65e98d748e1df492099fa6692d0bbc78f032df68e7028a28af06b5c27394456159351a6469fdaf777e6eb98609331076