Overview
overview
10Static
static
1NOTIFICACI...ca.exe
windows7-x64
10NOTIFICACI...ca.exe
windows10-2004-x64
10NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI...nv.dll
windows7-x64
3NOTIFICACI...nv.dll
windows10-2004-x64
3NOTIFICACI...tl.dll
windows7-x64
1NOTIFICACI...tl.dll
windows10-2004-x64
3NOTIFICACI...o.html
windows7-x64
1NOTIFICACI...o.html
windows10-2004-x64
1NOTIFICACI...ls.dll
windows7-x64
1NOTIFICACI...ls.dll
windows10-2004-x64
3NOTIFICACI...28.exe
windows7-x64
5NOTIFICACI...28.exe
windows10-2004-x64
5Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win10v2004-20240412-en
General
-
Target
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
-
Size
63KB
-
MD5
ae224c5e196ff381836c9e95deebb7d5
-
SHA1
910446a2a0f4e53307b6fdeb1a3e236c929e2ef4
-
SHA256
bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
-
SHA512
f845dbb13b04f76b6823bec48e1c47f96bcbd6d02a834c8b128ac750fe338b53f775ee2a8784e8c443d49dfcb918c5b9d59b5492a1fe18743b8ba65b7d12514c
-
SSDEEP
1536:Wio8DVyYs7JZT0uPXn8OS6sIe3ekT5Z240jSZk:WkhyYIJZT0uPXn8OdsIe3c4Ql
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
sostener2024.duckdns.org:2020
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-78-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1740-82-0x0000000004380000-0x00000000043C0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects file containing reversed ASEP Autorun registry keys 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-78-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse behavioral1/memory/1740-80-0x0000000004380000-0x00000000043C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse behavioral1/memory/1740-82-0x0000000004380000-0x00000000043C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse -
Suspicious use of SetThreadContext 2 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 2088 set thread context of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2856 set thread context of 1740 2856 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\Bj_Javav4.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 2088 01Notificacion juridica.exe 2856 cmd.exe 2856 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 2088 01Notificacion juridica.exe 2856 cmd.exe 2856 cmd.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 2088 wrote to memory of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2088 wrote to memory of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2088 wrote to memory of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2088 wrote to memory of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2088 wrote to memory of 2856 2088 01Notificacion juridica.exe cmd.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe PID 2856 wrote to memory of 1740 2856 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9b97b999Filesize
774KB
MD54a056ecbe98356cc77044f5e0d2821f5
SHA19be0066b699b4e5aace63f7122dea8817f98d725
SHA256417da123f30832041f938dee30a5e082775f75158b60c42469bd8c645f869ad6
SHA5122c1a0b6928b88cdca09ce3b9212de2b60e0ccb4bc056d228f51b9374baecee2885504a3da46f6b53cfeff09594eb15cfd65c57da92c4af183927160899cce53a
-
memory/1740-76-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1740-82-0x0000000004380000-0x00000000043C0000-memory.dmpFilesize
256KB
-
memory/1740-81-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB
-
memory/1740-80-0x0000000004380000-0x00000000043C0000-memory.dmpFilesize
256KB
-
memory/1740-79-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB
-
memory/1740-78-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1740-77-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1740-75-0x0000000072D50000-0x0000000073DB2000-memory.dmpFilesize
16.4MB
-
memory/2088-14-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2088-0-0x00000000004D0000-0x00000000005D8000-memory.dmpFilesize
1.0MB
-
memory/2088-13-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2088-4-0x00000000777D0000-0x0000000077979000-memory.dmpFilesize
1.7MB
-
memory/2088-3-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2088-2-0x0000000000E40000-0x0000000000E51000-memory.dmpFilesize
68KB
-
memory/2856-65-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2856-72-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2856-73-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2856-63-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB
-
memory/2856-18-0x00000000777D0000-0x0000000077979000-memory.dmpFilesize
1.7MB
-
memory/2856-16-0x0000000074D30000-0x0000000074EA4000-memory.dmpFilesize
1.5MB