Overview
overview
10Static
static
1NOTIFICACI...ca.exe
windows7-x64
10NOTIFICACI...ca.exe
windows10-2004-x64
10NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI....0.dll
windows7-x64
1NOTIFICACI....0.dll
windows10-2004-x64
3NOTIFICACI...nv.dll
windows7-x64
3NOTIFICACI...nv.dll
windows10-2004-x64
3NOTIFICACI...tl.dll
windows7-x64
1NOTIFICACI...tl.dll
windows10-2004-x64
3NOTIFICACI...o.html
windows7-x64
1NOTIFICACI...o.html
windows10-2004-x64
1NOTIFICACI...ls.dll
windows7-x64
1NOTIFICACI...ls.dll
windows10-2004-x64
3NOTIFICACI...28.exe
windows7-x64
5NOTIFICACI...28.exe
windows10-2004-x64
5Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 09:26
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gobject-2.0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/iconv.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/intl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/peso.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
NOTIFICACION_JUDICIAL/Winzip/winzip28.exe
Resource
win10v2004-20240412-en
General
-
Target
NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/01Notificacion juridica.exe
-
Size
63KB
-
MD5
ae224c5e196ff381836c9e95deebb7d5
-
SHA1
910446a2a0f4e53307b6fdeb1a3e236c929e2ef4
-
SHA256
bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
-
SHA512
f845dbb13b04f76b6823bec48e1c47f96bcbd6d02a834c8b128ac750fe338b53f775ee2a8784e8c443d49dfcb918c5b9d59b5492a1fe18743b8ba65b7d12514c
-
SSDEEP
1536:Wio8DVyYs7JZT0uPXn8OS6sIe3ekT5Z240jSZk:WkhyYIJZT0uPXn8OdsIe3c4Ql
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
sostener2024.duckdns.org:2020
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 652 set thread context of 2300 652 01Notificacion juridica.exe cmd.exe PID 2300 set thread context of 2512 2300 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\Bj_Javav4.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 652 01Notificacion juridica.exe 2300 cmd.exe 2300 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
01Notificacion juridica.execmd.exepid process 652 01Notificacion juridica.exe 2300 cmd.exe 2300 cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
01Notificacion juridica.execmd.exedescription pid process target process PID 652 wrote to memory of 2300 652 01Notificacion juridica.exe cmd.exe PID 652 wrote to memory of 2300 652 01Notificacion juridica.exe cmd.exe PID 652 wrote to memory of 2300 652 01Notificacion juridica.exe cmd.exe PID 652 wrote to memory of 2300 652 01Notificacion juridica.exe cmd.exe PID 2300 wrote to memory of 2512 2300 cmd.exe MSBuild.exe PID 2300 wrote to memory of 2512 2300 cmd.exe MSBuild.exe PID 2300 wrote to memory of 2512 2300 cmd.exe MSBuild.exe PID 2300 wrote to memory of 2512 2300 cmd.exe MSBuild.exe PID 2300 wrote to memory of 2512 2300 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\01Notificacion juridica.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7eb43c71Filesize
774KB
MD5c320c32c5fb992d63ba7c8fccfe1f666
SHA1b017b5e4eddc36955de15da1b149f02e7dcc248c
SHA256b9b351171d3081d77a6c29be7c52989ecc8eb76796f540f360813ab5a3f47806
SHA512e81256e80d6d94bb765ce36d201dac76b44f2ed18f57c14e18747b85e2a2e350ae8343316b280a88df5d47c839fbd6aeab36dcabf2afcbae49d991266036dd51
-
memory/652-0-0x0000000000A50000-0x0000000000A61000-memory.dmpFilesize
68KB
-
memory/652-1-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/652-2-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmpFilesize
2.0MB
-
memory/652-11-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/652-12-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-18-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-16-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmpFilesize
2.0MB
-
memory/2300-14-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-19-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-22-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-23-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2300-25-0x00000000753B0000-0x000000007552B000-memory.dmpFilesize
1.5MB
-
memory/2512-26-0x0000000073840000-0x0000000074A94000-memory.dmpFilesize
18.3MB
-
memory/2512-30-0x0000000073090000-0x0000000073840000-memory.dmpFilesize
7.7MB
-
memory/2512-29-0x0000000000FC0000-0x0000000000FD6000-memory.dmpFilesize
88KB
-
memory/2512-31-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/2512-32-0x0000000073090000-0x0000000073840000-memory.dmpFilesize
7.7MB
-
memory/2512-33-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB