Analysis
- max time kernel
92s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 01:34
General
- Target 2024-04-04_b551cf50e3ccd4203e535807992d7334_icedid.exe
- Size 3.2MB
- Sample240404-bzdjnsbc77
- SHA256 00611bc2d5471b2c967ab91ca75a58070c5ddf1a2a18b0cb9988cd447c1e9fd0
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
ABRIL - 01 - 2024
-
reverseproxy.con-ip.com:4000
-
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detects executables attemping to enumerate video devices using WMI 3 IoCs
- Detects executables containing the string DcRatBy 3 IoCs
- Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_b551cf50e3ccd4203e535807992d7334_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_b551cf50e3ccd4203e535807992d7334_icedid.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-6-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/1036-3-0x0000000000F40000-0x0000000000F52000-memory.dmp
memory/1036-5-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1036-9-0x0000000005E50000-0x0000000005EEC000-memory.dmp
memory/1036-10-0x00000000064A0000-0x0000000006A44000-memory.dmp
memory/1036-11-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/1036-12-0x0000000072510000-0x0000000072522000-memory.dmp
memory/1036-13-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1036-14-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/4480-1-0x0000000000400000-0x000000000078D000-memory.dmp
memory/4480-2-0x0000000000400000-0x000000000078D000-memory.dmp
memory/4480-4-0x0000000000400000-0x000000000078D000-memory.dmp
memory/4480-0-0x0000000000400000-0x000000000078D000-memory.dmp