Analysis
-
max time kernel
146s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:14
Behavioral task
behavioral1
Sample
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
Resource
win10v2004-20240319-en
General
-
Target
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe
-
Size
63KB
-
MD5
c1ade258f05c512e98ebc4d9d1165f8a
-
SHA1
acf20f6a7dc7841ae06f801b887289fdc99e0488
-
SHA256
447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759
-
SHA512
5b652e0ef6293d7baeb7e9d8b79322ec65e98d748e1df492099fa6692d0bbc78f032df68e7028a28af06b5c27394456159351a6469fdaf777e6eb98609331076
-
SSDEEP
1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Exodus_Market
leetboy.dynuddns.net:1339
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
svchos.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023358-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe -
Executes dropped EXE 1 IoCs
pid Process 3764 svchos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4464 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5088 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 3764 svchos.exe 3764 svchos.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe Token: SeDebugPrivilege 3764 svchos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3764 svchos.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3716 wrote to memory of 4724 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 102 PID 3716 wrote to memory of 4724 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 102 PID 3716 wrote to memory of 4724 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 102 PID 3716 wrote to memory of 2600 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 104 PID 3716 wrote to memory of 2600 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 104 PID 3716 wrote to memory of 2600 3716 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe 104 PID 4724 wrote to memory of 4464 4724 cmd.exe 106 PID 4724 wrote to memory of 4464 4724 cmd.exe 106 PID 4724 wrote to memory of 4464 4724 cmd.exe 106 PID 2600 wrote to memory of 5088 2600 cmd.exe 107 PID 2600 wrote to memory of 5088 2600 cmd.exe 107 PID 2600 wrote to memory of 5088 2600 cmd.exe 107 PID 2600 wrote to memory of 3764 2600 cmd.exe 109 PID 2600 wrote to memory of 3764 2600 cmd.exe 109 PID 2600 wrote to memory of 3764 2600 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe"C:\Users\Admin\AppData\Local\Temp\447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"'3⤵
- Creates scheduled task(s)
PID:4464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9AC9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:5088
-
-
C:\Users\Admin\AppData\Roaming\svchos.exe"C:\Users\Admin\AppData\Roaming\svchos.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3764
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:81⤵PID:1036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD56d28b4e459b79a10315874863a5b517e
SHA138633c677fa3cc4d57dca911181e2d59a3a09c81
SHA2566176a1cd408f8273f51b37a99794f8ec16d60bc4f511af6547806d7389461282
SHA512082bd169a74604ebd3abbc108321bbf8452835262d273e5c3565687e26f3c5ac2209128b14c8f7c30fce2c5ced21cf00b42b60a01d7708993b6ed402bde3e609
-
Filesize
63KB
MD5c1ade258f05c512e98ebc4d9d1165f8a
SHA1acf20f6a7dc7841ae06f801b887289fdc99e0488
SHA256447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759
SHA5125b652e0ef6293d7baeb7e9d8b79322ec65e98d748e1df492099fa6692d0bbc78f032df68e7028a28af06b5c27394456159351a6469fdaf777e6eb98609331076