Analysis
- max time kernel
146s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 19:55
General
- Target f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe
- Size 169KB
- Sample240416-ynfk8acf6v
- SHA256 d82786dd43e20aea1972646855e9714d053e86bd41cb5d8767ff038c52cce68f
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
info07.ddns.net:1177
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sys.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f436f06e1b7e1d1e6f795ca10086a5e9_JaffaCakes118.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3oaz5f2d.j3s.ps1
memory/184-29-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-51-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/184-63-0x0000000075060000-0x0000000075810000-memory.dmp
memory/184-33-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-50-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-46-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-4-0x0000000005F30000-0x00000000064D4000-memory.dmp
memory/184-48-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-44-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-9-0x0000000005A50000-0x0000000005A60000-memory.dmp
memory/184-11-0x00000000059F0000-0x0000000005A0C000-memory.dmp
memory/184-39-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-42-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-1-0x0000000075060000-0x0000000075810000-memory.dmp
memory/184-20-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-14-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-3-0x0000000075060000-0x0000000075810000-memory.dmp
memory/184-22-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-31-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/184-0-0x0000000000D10000-0x0000000000D40000-memory.dmp
memory/184-2-0x00000000056E0000-0x000000000577C000-memory.dmp
memory/184-36-0x00000000059F0000-0x0000000005A05000-memory.dmp
memory/452-53-0x0000000075060000-0x0000000075810000-memory.dmp
memory/452-65-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/452-64-0x0000000075060000-0x0000000075810000-memory.dmp
memory/452-61-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/452-52-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4052-10-0x0000000004BD0000-0x00000000051F8000-memory.dmp
memory/4052-54-0x0000000006A20000-0x0000000006AB6000-memory.dmp
memory/4052-7-0x00000000021F0000-0x0000000002200000-memory.dmp
memory/4052-6-0x0000000075060000-0x0000000075810000-memory.dmp
memory/4052-23-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/4052-12-0x0000000005200000-0x0000000005222000-memory.dmp
memory/4052-5-0x00000000021B0000-0x00000000021E6000-memory.dmp
memory/4052-8-0x00000000021F0000-0x0000000002200000-memory.dmp
memory/4052-55-0x0000000005F60000-0x0000000005F7A000-memory.dmp
memory/4052-56-0x0000000005FE0000-0x0000000006002000-memory.dmp
memory/4052-60-0x0000000075060000-0x0000000075810000-memory.dmp
memory/4052-13-0x0000000005370000-0x00000000053D6000-memory.dmp
memory/4052-35-0x00000000055C0000-0x0000000005914000-memory.dmp
memory/4052-40-0x0000000005AB0000-0x0000000005AFC000-memory.dmp
memory/4052-37-0x0000000005A70000-0x0000000005A8E000-memory.dmp