Analysis

  • max time kernel
    159s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 20:20

General

  • Target

    e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe

  • Size

    493KB

  • MD5

    e8545399823b411ea6cb927e80aded0f

  • SHA1

    22af521e6119003289b6bd5d7be9a3328acb59cc

  • SHA256

    3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e

  • SHA512

    91b5f2c5fda648d4b54e5a434cb8848c3b1a51627387d552d12461adbc4f1925d3a1f23321f36e6404d6d7eff616cd428f648e5b44384f2c394e2777f0b938f6

  • SSDEEP

    6144:WE3WAe1LXFPQbIQrn7xVEcMXBvsEbfKBqwOwD71tJ71Py6QSIRhg0ST7IYzMTFOB:WKWAebYYc4hbmOwD71tJha6QSGdAF7

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

ControllerFinallineballinglove33.webredirect.org:7719

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    Abobe.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe,"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe,"
        3⤵
        • Modifies WinLogon for persistence
        PID:3104
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe"
        3⤵
        • Executes dropped EXE
        PID:4008
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:772

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sys30.exe.log

      Filesize

      2KB

      MD5

      232c537b9de63796f124d6e7c3afcbd9

      SHA1

      cfa10e8cfc64eaaa0f2b17363a65426c41729e9d

      SHA256

      da9ff8d5d3ad1a97c7f369973506ad780565ef44ed7f89df850cc6be5d07801c

      SHA512

      0157b54708b6a33497bd3eabc07f6c17ad784882afcd18be8ffcdb835564ab9d43c5be25347db0a715fc32d70f116026dd11db15005ec0cdc13f8acea44e7eb9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe

      Filesize

      493KB

      MD5

      e8545399823b411ea6cb927e80aded0f

      SHA1

      22af521e6119003289b6bd5d7be9a3328acb59cc

      SHA256

      3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e

      SHA512

      91b5f2c5fda648d4b54e5a434cb8848c3b1a51627387d552d12461adbc4f1925d3a1f23321f36e6404d6d7eff616cd428f648e5b44384f2c394e2777f0b938f6

    • memory/2348-13-0x0000000006020000-0x0000000006030000-memory.dmp

      Filesize

      64KB

    • memory/2348-1-0x0000000000F10000-0x0000000000F92000-memory.dmp

      Filesize

      520KB

    • memory/2348-3-0x0000000005930000-0x00000000059CC000-memory.dmp

      Filesize

      624KB

    • memory/2348-5-0x0000000006A80000-0x0000000006AA8000-memory.dmp

      Filesize

      160KB

    • memory/2348-28-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/2348-7-0x0000000006BE0000-0x0000000006C02000-memory.dmp

      Filesize

      136KB

    • memory/2348-8-0x0000000006E30000-0x0000000006EC2000-memory.dmp

      Filesize

      584KB

    • memory/2348-9-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/2348-10-0x0000000006020000-0x0000000006030000-memory.dmp

      Filesize

      64KB

    • memory/2348-11-0x0000000006020000-0x0000000006030000-memory.dmp

      Filesize

      64KB

    • memory/2348-0-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/2348-2-0x0000000005AF0000-0x0000000005E44000-memory.dmp

      Filesize

      3.3MB

    • memory/2348-4-0x0000000006020000-0x0000000006030000-memory.dmp

      Filesize

      64KB

    • memory/2348-6-0x0000000006C20000-0x0000000006C86000-memory.dmp

      Filesize

      408KB

    • memory/2940-27-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB

    • memory/2940-25-0x0000000005420000-0x0000000005430000-memory.dmp

      Filesize

      64KB

    • memory/2940-29-0x0000000006470000-0x0000000006484000-memory.dmp

      Filesize

      80KB

    • memory/2940-30-0x00000000068B0000-0x00000000068B6000-memory.dmp

      Filesize

      24KB

    • memory/2940-24-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/2940-35-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/4008-31-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4008-36-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/4008-37-0x0000000005030000-0x0000000005040000-memory.dmp

      Filesize

      64KB

    • memory/4008-38-0x0000000074AD0000-0x0000000075280000-memory.dmp

      Filesize

      7.7MB

    • memory/4008-39-0x0000000005030000-0x0000000005040000-memory.dmp

      Filesize

      64KB