Overview
overview
10Static
static
1NOTIFICACI...ca.exe
windows7-x64
10NOTIFICACI...ca.exe
windows10-2004-x64
10NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI...nv.dll
windows7-x64
3NOTIFICACI...nv.dll
windows10-2004-x64
3NOTIFICACI...tl.dll
windows7-x64
1NOTIFICACI...tl.dll
windows10-2004-x64
3NOTIFICACI...o.html
windows7-x64
1NOTIFICACI...o.html
windows10-2004-x64
1NOTIFICACI...ls.dll
windows7-x64
1NOTIFICACI...ls.dll
windows10-2004-x64
3NOTIFICACI...28.exe
windows7-x64
5NOTIFICACI...28.exe
windows10-2004-x64
5Analysis
-
max time kernel
140s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win10v2004-20240412-en
General
-
Target
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
-
Size
63KB
-
MD5
ae224c5e196ff381836c9e95deebb7d5
-
SHA1
910446a2a0f4e53307b6fdeb1a3e236c929e2ef4
-
SHA256
bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
-
SHA512
f845dbb13b04f76b6823bec48e1c47f96bcbd6d02a834c8b128ac750fe338b53f775ee2a8784e8c443d49dfcb918c5b9d59b5492a1fe18743b8ba65b7d12514c
-
SSDEEP
1536:Wio8DVyYs7JZT0uPXn8OS6sIe3ekT5Z240jSZk:WkhyYIJZT0uPXn8OdsIe3c4Ql
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
sostener2024.duckdns.org:2020
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5024-31-0x0000000000560000-0x0000000000576000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects file containing reversed ASEP Autorun registry keys 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5024-31-0x0000000000560000-0x0000000000576000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse -
Suspicious use of SetThreadContext 2 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 4160 set thread context of 3852 4160 01Notificacion juridica.exe cmd.exe PID 3852 set thread context of 5024 3852 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\Bj_Javav4.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 4160 01Notificacion juridica.exe 3852 cmd.exe 3852 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 4160 01Notificacion juridica.exe 3852 cmd.exe 3852 cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 4160 wrote to memory of 3852 4160 01Notificacion juridica.exe cmd.exe PID 4160 wrote to memory of 3852 4160 01Notificacion juridica.exe cmd.exe PID 4160 wrote to memory of 3852 4160 01Notificacion juridica.exe cmd.exe PID 4160 wrote to memory of 3852 4160 01Notificacion juridica.exe cmd.exe PID 3852 wrote to memory of 5024 3852 cmd.exe MSBuild.exe PID 3852 wrote to memory of 5024 3852 cmd.exe MSBuild.exe PID 3852 wrote to memory of 5024 3852 cmd.exe MSBuild.exe PID 3852 wrote to memory of 5024 3852 cmd.exe MSBuild.exe PID 3852 wrote to memory of 5024 3852 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4280 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4092e89aFilesize
774KB
MD58cc45782dcfa91031525826d9fdb3bb1
SHA16057ae59fbe3861ef3acce900e53222f9707590b
SHA2565af923ca4d93f46915d9460f7f95384aa065a02389b66e36a0d0d28e877c8661
SHA512ed0d47764eab9f4f58e6a53e0d4da866cfaa7eb1cf31ea73fd8cef9b601af1e86fcff1f6b9356882a81dd88eda9e99e65d776153b2fc4016a3439721ff29ffe1
-
memory/3852-24-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/3852-17-0x00007FFE8D4D0000-0x00007FFE8D6C5000-memory.dmpFilesize
2.0MB
-
memory/3852-20-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/3852-23-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/3852-19-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/3852-15-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/4160-11-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/4160-1-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/4160-2-0x00007FFE8D4D0000-0x00007FFE8D6C5000-memory.dmpFilesize
2.0MB
-
memory/4160-12-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/4160-0-0x0000000000CB0000-0x0000000000CC1000-memory.dmpFilesize
68KB
-
memory/4160-13-0x00000000750B0000-0x000000007522B000-memory.dmpFilesize
1.5MB
-
memory/5024-34-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/5024-26-0x0000000073540000-0x0000000074794000-memory.dmpFilesize
18.3MB
-
memory/5024-30-0x0000000074B20000-0x00000000752D0000-memory.dmpFilesize
7.7MB
-
memory/5024-31-0x0000000000560000-0x0000000000576000-memory.dmpFilesize
88KB
-
memory/5024-32-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/5024-33-0x0000000074B20000-0x00000000752D0000-memory.dmpFilesize
7.7MB