Analysis
- max time kernel
1205s - max time network
1216s - platform
windows10-1703_x64 - resource
win10-20240404-es - resource tags
- submitted
04/04/2024, 22:10
General
- Target DOCRAD0404INFOPDF2024RAD001.exe
- Size 2.3MB
- Sample240404-13rm5sbd6z
- SHA256 b219c4089fa80f02dd5ba6b280c0a3794af9cacf7460d090f23a56fb100d558c
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
MASTER01
-
armadnocaballerodominio.con-ip.com:4041
-
Cookies
-
delay
3
-
install
false
-
install_file
winu32.exe
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCRAD0404INFOPDF2024RAD001.exe"C:\Users\Admin\AppData\Local\Temp\DOCRAD0404INFOPDF2024RAD001.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3876-4897-0x0000000000500000-0x0000000000512000-memory.dmp
memory/3876-4899-0x00000000733D0000-0x0000000073ABE000-memory.dmp
memory/3876-4900-0x00000000049F0000-0x0000000004A00000-memory.dmp
memory/3876-4901-0x00000000733D0000-0x0000000073ABE000-memory.dmp
memory/3876-4902-0x00000000049F0000-0x0000000004A00000-memory.dmp
memory/4248-34-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-12-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-2-0x0000000005980000-0x0000000005990000-memory.dmp
memory/4248-3-0x0000000005990000-0x0000000005BB0000-memory.dmp
memory/4248-4-0x0000000006CE0000-0x0000000006F00000-memory.dmp
memory/4248-5-0x0000000007400000-0x00000000078FE000-memory.dmp
memory/4248-6-0x0000000006F00000-0x0000000006F92000-memory.dmp
memory/4248-7-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-8-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-40-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-38-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-14-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-16-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-18-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-20-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-22-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-24-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-26-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-28-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-30-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-32-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-0-0x0000000000CD0000-0x0000000000F18000-memory.dmp
memory/4248-1-0x00000000733D0000-0x0000000073ABE000-memory.dmp
memory/4248-36-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-10-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-42-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-44-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-46-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-48-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-50-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-52-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-54-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-56-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-58-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-60-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-62-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-64-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-66-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-68-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-70-0x0000000006CE0000-0x0000000006EFA000-memory.dmp
memory/4248-2170-0x00000000733D0000-0x0000000073ABE000-memory.dmp
memory/4248-2429-0x0000000005980000-0x0000000005990000-memory.dmp
memory/4248-4889-0x0000000005930000-0x0000000005931000-memory.dmp
memory/4248-4890-0x00000000071A0000-0x00000000071FC000-memory.dmp
memory/4248-4891-0x0000000007340000-0x000000000738C000-memory.dmp
memory/4248-4892-0x0000000001800000-0x0000000001854000-memory.dmp
memory/4248-4893-0x0000000007A10000-0x0000000007B12000-memory.dmp
memory/4248-4898-0x00000000733D0000-0x0000000073ABE000-memory.dmp