Analysis
- max time kernel
145s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 22:08
General
- Target a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe
- Size 362KB
- Sample240403-12grjsec6v
- SHA256 9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
194.5.97.212:1199
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systems.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
a7f39a5fb34ce604deeccf9114134280_JaffaCakes118.exe.log
__PSScriptPolicyTest_l554ew0h.1af.ps1
memory/116-67-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/116-66-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/116-65-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/116-64-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/116-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/972-33-0x0000000004B40000-0x0000000004B66000-memory.dmp
memory/972-56-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-1-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/972-2-0x0000000004A50000-0x0000000004AEC000-memory.dmp
memory/972-63-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/972-59-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/972-58-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-54-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-52-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-50-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-48-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-44-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-46-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-31-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/972-32-0x0000000004B90000-0x0000000004BA0000-memory.dmp
memory/972-0-0x0000000000090000-0x00000000000F2000-memory.dmp
memory/972-34-0x0000000004B70000-0x0000000004B8C000-memory.dmp
memory/972-35-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-36-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-38-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-40-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/972-42-0x0000000004B70000-0x0000000004B85000-memory.dmp
memory/2260-20-0x0000000005DF0000-0x0000000006144000-memory.dmp
memory/2260-5-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/2260-25-0x00000000067E0000-0x0000000006802000-memory.dmp
memory/2260-24-0x0000000006790000-0x00000000067AA000-memory.dmp
memory/2260-23-0x00000000073B0000-0x0000000007446000-memory.dmp
memory/2260-22-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/2260-26-0x0000000007A00000-0x0000000007FA4000-memory.dmp
memory/2260-8-0x00000000052D0000-0x00000000052F2000-memory.dmp
memory/2260-30-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2260-21-0x0000000006310000-0x000000000632E000-memory.dmp
memory/2260-6-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/2260-7-0x0000000005410000-0x0000000005A38000-memory.dmp
memory/2260-4-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2260-3-0x0000000002950000-0x0000000002986000-memory.dmp
memory/2260-10-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/2260-9-0x0000000005370000-0x00000000053D6000-memory.dmp