Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 21:53
Behavioral task
behavioral1
Sample
assssss.exe
Resource
win7-20240221-en
General
-
Target
assssss.exe
-
Size
74KB
-
MD5
00633c71d9fa6e703dacc8c6266b2613
-
SHA1
c673396470a64a46c5c96643aa7558a35722faf2
-
SHA256
cef1b063659f6f90cb4a3d0dc14295919ea7c11020918d9c3a01a7705dd2e175
-
SHA512
840a93b7d5e992176f672618b8f4f23f0e697093656914525229555970dd91c19ceec1996d6d00d5ca372b029e944164d73d36d19994ad5c435618b6efa8f0cf
-
SSDEEP
1536:eUYccx0dxCKg6PMV1QKI/H1bz/uVSjhaQzcaLVclN:eUlcx0f9g6PMV1QzH1bzW6haQLBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
66.66.146.74:9511
kvudvdwyjbukkqcnuoq
-
delay
1
-
install
true
-
install_file
Windows Host.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000300000001e5e0-13.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation assssss.exe -
Executes dropped EXE 1 IoCs
pid Process 4004 Windows Host.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4304 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4080 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 3280 assssss.exe 4004 Windows Host.exe 4004 Windows Host.exe 4004 Windows Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3280 assssss.exe Token: SeDebugPrivilege 4004 Windows Host.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4004 Windows Host.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3280 wrote to memory of 5116 3280 assssss.exe 88 PID 3280 wrote to memory of 5116 3280 assssss.exe 88 PID 3280 wrote to memory of 1664 3280 assssss.exe 89 PID 3280 wrote to memory of 1664 3280 assssss.exe 89 PID 1664 wrote to memory of 4080 1664 cmd.exe 92 PID 1664 wrote to memory of 4080 1664 cmd.exe 92 PID 5116 wrote to memory of 4304 5116 cmd.exe 93 PID 5116 wrote to memory of 4304 5116 cmd.exe 93 PID 1664 wrote to memory of 4004 1664 cmd.exe 95 PID 1664 wrote to memory of 4004 1664 cmd.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\assssss.exe"C:\Users\Admin\AppData\Local\Temp\assssss.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Host" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows Host.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Host" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows Host.exe"'3⤵
- Creates scheduled task(s)
PID:4304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7772.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Host.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD500633c71d9fa6e703dacc8c6266b2613
SHA1c673396470a64a46c5c96643aa7558a35722faf2
SHA256cef1b063659f6f90cb4a3d0dc14295919ea7c11020918d9c3a01a7705dd2e175
SHA512840a93b7d5e992176f672618b8f4f23f0e697093656914525229555970dd91c19ceec1996d6d00d5ca372b029e944164d73d36d19994ad5c435618b6efa8f0cf
-
Filesize
159B
MD5f71ae9567260e80de0d74b8563eba396
SHA1c82f906b4ef422c1f0554902e8e7361d5bcdc8c6
SHA2560c3c009d16f91af265fed09f9a36c4c8087003fae69573809f8941eafc1c6977
SHA512d5346ffb7d97f941a8b46ab7e3eae3ba8e0910bb27138209ae97e33174780fc49e63d386cba55dd7d0f9b23b172cce1ce081e78602ec04def037612af9f99a6e
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b