Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 00:59
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240221-en
General
-
Target
Client.exe
-
Size
74KB
-
MD5
feb7c3f368154a08ad7e52261979c08e
-
SHA1
2131d762af7a5658ae4300082cbbfc61e5c42225
-
SHA256
d17e143abae10ae5cd25c20e711365eb23b4c96cf0c03d09779faf8770d4c023
-
SHA512
2a2c5abe02366fbbc632032391573e0c674136148cfed6968a02b2318cbabbd2c0e5395c3cd3179aaa25670300b5a071842c4b31423c24b87e657fc4c1210734
-
SSDEEP
1536:iUKUcxoyR1CriPMVie9VdQuDI6H1bf/guQzcuLVclN:iUzcxoyXkiPMVie9VdQsH1bf7QnBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
66.66.146.74:9511
ftjoxyioflhynjghiu
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000300000001e5e0-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation Client.exe -
Executes dropped EXE 1 IoCs
pid Process 2676 svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4136 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4084 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 3432 Client.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3432 Client.exe Token: SeDebugPrivilege 2676 svchost.exe Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4436 3432 Client.exe 88 PID 3432 wrote to memory of 4436 3432 Client.exe 88 PID 3432 wrote to memory of 1272 3432 Client.exe 89 PID 3432 wrote to memory of 1272 3432 Client.exe 89 PID 4436 wrote to memory of 4136 4436 cmd.exe 92 PID 4436 wrote to memory of 4136 4436 cmd.exe 92 PID 1272 wrote to memory of 4084 1272 cmd.exe 93 PID 1272 wrote to memory of 4084 1272 cmd.exe 93 PID 1272 wrote to memory of 2676 1272 cmd.exe 95 PID 1272 wrote to memory of 2676 1272 cmd.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:4136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9182.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4084
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x2fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD561ff64692be1857fee234f81bb4c7b7a
SHA11356848f3d5e2633020ad4827589cdf5281391df
SHA256913790aa96af7ae95152558ad0639adb96bec82154518e43fc44e81f97b288e1
SHA512b9ac5263e0c252c9dd2a45811d8329db331af507096379aba93ea4a87b98b18cc2f6bae4cc676235454cb718d8efa39cbd8fd5cbe2be442772e05a6437765b05
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD5feb7c3f368154a08ad7e52261979c08e
SHA12131d762af7a5658ae4300082cbbfc61e5c42225
SHA256d17e143abae10ae5cd25c20e711365eb23b4c96cf0c03d09779faf8770d4c023
SHA5122a2c5abe02366fbbc632032391573e0c674136148cfed6968a02b2318cbabbd2c0e5395c3cd3179aaa25670300b5a071842c4b31423c24b87e657fc4c1210734