Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-04-2024 17:57

General

  • Target

    VantaFN.exe

  • Size

    3.8MB

  • MD5

    84699018b1132b73d8063290faa07789

  • SHA1

    7d1eec5ae60f0a0383f723f1e001dfc6c2c76aac

  • SHA256

    d35c91227f48c494930749f5486054244686328ad8e02960a6b0b10226bc174c

  • SHA512

    d7d29eaeacb5d4289aa0a3bbdf071f2e875bf307e326829432cfbbcff1b19e3eaccfc81ec5ebcbf2beab7dee8aff05ad8c086ac0e61a0837339f4febabef5ade

  • SSDEEP

    1536:ftTXAtyLaVfblJpAGUbVh9CU5uodpqKmY7:fWyaVPaGUbVjzGz

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Mutex

Δ2cΕmVO比L西IVurs诶Eש8

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/z5PQ82wE

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\VantaFN.exe
    "C:\Users\Admin\AppData\Local\Temp\VantaFN.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:828
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5DEF.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2584
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5DEF.tmp.bat

    Filesize

    151B

    MD5

    58316bab4221296491da4c475300158a

    SHA1

    e6d939574c4729346a4f46911bc928723f8b659f

    SHA256

    5541aec8ad76ab74ed2f30c8ae203b5abcb018908c1678223faf315992934d96

    SHA512

    8ad5a981f7207270101c6880ddd351a18d26c7e7078226fe5a095dcecb89d16e5f7e533a68fee00a2030089a2bbd15b1dbe77a99ec1c7b3743780073b246835f

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    3.8MB

    MD5

    84699018b1132b73d8063290faa07789

    SHA1

    7d1eec5ae60f0a0383f723f1e001dfc6c2c76aac

    SHA256

    d35c91227f48c494930749f5486054244686328ad8e02960a6b0b10226bc174c

    SHA512

    d7d29eaeacb5d4289aa0a3bbdf071f2e875bf307e326829432cfbbcff1b19e3eaccfc81ec5ebcbf2beab7dee8aff05ad8c086ac0e61a0837339f4febabef5ade

  • memory/1840-14-0x00007FFC012B0000-0x00007FFC01C9C000-memory.dmp

    Filesize

    9.9MB

  • memory/1840-19-0x00007FFC11CB0000-0x00007FFC11E8B000-memory.dmp

    Filesize

    1.9MB

  • memory/1840-18-0x000000001B700000-0x000000001B800000-memory.dmp

    Filesize

    1024KB

  • memory/1840-17-0x00007FFC012B0000-0x00007FFC01C9C000-memory.dmp

    Filesize

    9.9MB

  • memory/1840-16-0x00007FFC11CB0000-0x00007FFC11E8B000-memory.dmp

    Filesize

    1.9MB

  • memory/1840-15-0x000000001B700000-0x000000001B800000-memory.dmp

    Filesize

    1024KB

  • memory/3152-3-0x00007FFC11CB0000-0x00007FFC11E8B000-memory.dmp

    Filesize

    1.9MB

  • memory/3152-10-0x00007FFC11CB0000-0x00007FFC11E8B000-memory.dmp

    Filesize

    1.9MB

  • memory/3152-9-0x00007FFC012B0000-0x00007FFC01C9C000-memory.dmp

    Filesize

    9.9MB

  • memory/3152-0-0x00000000007D0000-0x00000000007E6000-memory.dmp

    Filesize

    88KB

  • memory/3152-2-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

    Filesize

    64KB

  • memory/3152-1-0x00007FFC012B0000-0x00007FFC01C9C000-memory.dmp

    Filesize

    9.9MB