Malware Analysis Report

2024-10-10 10:08

Sample ID 240419-zpx3bsfc76
Target C11Bootstrapper.zip
SHA256 fc1ad8d1483f0b1c94b55be7b7587b86485022ca4e62e6fb0c06e392dfaeecd2
Tags
rat default asyncrat umbral
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc1ad8d1483f0b1c94b55be7b7587b86485022ca4e62e6fb0c06e392dfaeecd2

Threat Level: Known bad

The file C11Bootstrapper.zip was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat umbral

Asyncrat family

Umbral family

AsyncRat

Async RAT payload

Detect Umbral payload

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-19 20:54

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Asyncrat family

asyncrat

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral family

umbral

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 20:54

Reported

2024-04-19 20:57

Platform

win7-20231129-en

Max time kernel

148s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe"

Signatures

AsyncRat

rat asyncrat

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe

"C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp

Files

memory/1700-0-0x0000000000DC0000-0x0000000000E04000-memory.dmp

memory/1700-2-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

memory/1700-3-0x000000001A780000-0x000000001A800000-memory.dmp

memory/1700-4-0x0000000077240000-0x00000000773E9000-memory.dmp

memory/1700-5-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

memory/1700-6-0x000000001A780000-0x000000001A800000-memory.dmp

memory/1700-7-0x0000000077240000-0x00000000773E9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 20:54

Reported

2024-04-19 20:57

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe"

Signatures

AsyncRat

rat asyncrat

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe

"C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.10:443 chromewebstore.googleapis.com tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp

Files

memory/1380-0-0x00000000003D0000-0x0000000000414000-memory.dmp

memory/1380-1-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

memory/1380-3-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

memory/1380-4-0x00007FF97B670000-0x00007FF97C131000-memory.dmp

memory/1380-5-0x000000001B2C0000-0x000000001B2D0000-memory.dmp