Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-04-2024 21:39

General

  • Target

    f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe

  • Size

    242KB

  • MD5

    f461e0baafcd9a9bc218ac8bfdd5e31a

  • SHA1

    65db47f933a688f831c6e785c1c600df3a85a79b

  • SHA256

    f23cdf7d982b3e0953701893f4104a186da68d8d56c4e8f99f798eff27b7fbae

  • SHA512

    83c80e5617880a17d88c31646257c1086801d6274a6e3bafe08bda39ea7bebc90fa384dca99d405005c65ed1be284304632bdaffdc6014be98b4ed68342776d7

  • SSDEEP

    6144:U209KyD6sAdiy2sTgond+7lQHsgNvxRtDcKPH7Pj5lDs:Un9KszAusTT6msg1RDc2BlDs

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

shortcut2021.duckdns.org:6002

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    systeam32.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
      "C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe"
      2⤵
      • Executes dropped EXE
      PID:2056
    • C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
      "C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
        "C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"
        3⤵
        • Executes dropped EXE
        PID:4780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe

    Filesize

    161KB

    MD5

    fb3ae19f3c99124fb0ed13205ba967c2

    SHA1

    4fc3d1efd07d29d657b2a8fb7bec3d05cd430627

    SHA256

    0a92b929cc8041cd868683116f3e7741cd22755a5ad57af56aa9bd6c54968c43

    SHA512

    faef6c2fd3a71a308df24174e189f40b5e0909f3c99886d449f1b738dd91cedc2dbbaa4146f56448eb392f67925792c028dd92778ca3a440ed751378e5631b75

  • C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

    Filesize

    195KB

    MD5

    269d7728dbb38468ba697dedc335d4e6

    SHA1

    3e6980bb5a3b0bf247800e6100dcbd7a97db2d4b

    SHA256

    b452105ebb3c208a7955ac226a26c5d9322921c26f055c9ef10a0b4c5a4ae7b5

    SHA512

    0ae87dceeb02bf0b9d27a304b44add4fecc2382a9c444013d8e5add04b4760fe121839aea10f9eada8497e01ac85b0c2db2673897c0273cfe8d4c0a3915df3b6

  • memory/2056-33-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2056-32-0x0000000000040000-0x000000000006E000-memory.dmp

    Filesize

    184KB

  • memory/2056-47-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4016-0-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/4016-1-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4016-29-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4016-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp

    Filesize

    584KB

  • memory/4016-5-0x0000000005160000-0x000000000516A000-memory.dmp

    Filesize

    40KB

  • memory/4016-4-0x00000000051B0000-0x00000000051C0000-memory.dmp

    Filesize

    64KB

  • memory/4016-2-0x00000000049B0000-0x0000000004F54000-memory.dmp

    Filesize

    5.6MB

  • memory/4780-50-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4780-49-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

    Filesize

    64KB

  • memory/4780-43-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4780-48-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4780-51-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

    Filesize

    64KB

  • memory/4896-37-0x00000000071B0000-0x00000000071CE000-memory.dmp

    Filesize

    120KB

  • memory/4896-39-0x0000000008710000-0x0000000008776000-memory.dmp

    Filesize

    408KB

  • memory/4896-41-0x0000000008780000-0x0000000008781000-memory.dmp

    Filesize

    4KB

  • memory/4896-38-0x00000000087B0000-0x000000000884C000-memory.dmp

    Filesize

    624KB

  • memory/4896-46-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4896-28-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4896-34-0x0000000005A80000-0x0000000005A90000-memory.dmp

    Filesize

    64KB

  • memory/4896-30-0x0000000000FF0000-0x0000000001026000-memory.dmp

    Filesize

    216KB

  • memory/4896-36-0x0000000007140000-0x000000000716A000-memory.dmp

    Filesize

    168KB

  • memory/4896-35-0x00000000070C0000-0x0000000007136000-memory.dmp

    Filesize

    472KB