Overview
overview
10Static
static
1001-NOTIFI...AL.exe
windows7-x64
10001-NOTIFI...AL.exe
windows10-2004-x64
10001-NOTIFI...64.exe
windows7-x64
001-NOTIFI...64.exe
windows10-2004-x64
001-NOTIFI....0.dll
windows7-x64
1001-NOTIFI....0.dll
windows10-2004-x64
3001-NOTIFI....0.dll
windows7-x64
1001-NOTIFI....0.dll
windows10-2004-x64
3001-NOTIFI....0.dll
windows7-x64
1001-NOTIFI....0.dll
windows10-2004-x64
3001-NOTIFI....0.dll
windows7-x64
1001-NOTIFI....0.dll
windows10-2004-x64
3001-NOTIFI...nv.dll
windows7-x64
3001-NOTIFI...nv.dll
windows10-2004-x64
3001-NOTIFI...tl.dll
windows7-x64
1001-NOTIFI...tl.dll
windows10-2004-x64
3001-NOTIFI...o.html
windows7-x64
1001-NOTIFI...o.html
windows10-2004-x64
1001-NOTIFI...ls.dll
windows7-x64
1001-NOTIFI...ls.dll
windows10-2004-x64
3Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 09:32
Static task
static1
Behavioral task
behavioral1
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/001-NOTIFICACION JUDICIAL.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/001-NOTIFICACION JUDICIAL.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/WINRAR/7z2301-arm64.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/WINRAR/7z2301-arm64.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/glib-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/glib-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gmodule-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gmodule-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gobject-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gobject-2.0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gthread-2.0.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gthread-2.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/iconv.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/iconv.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/intl.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/intl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/peso.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/peso.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/vmtools.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/vmtools.dll
Resource
win10v2004-20240412-en
General
-
Target
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/001-NOTIFICACION JUDICIAL.exe
-
Size
63KB
-
MD5
ae224c5e196ff381836c9e95deebb7d5
-
SHA1
910446a2a0f4e53307b6fdeb1a3e236c929e2ef4
-
SHA256
bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
-
SHA512
f845dbb13b04f76b6823bec48e1c47f96bcbd6d02a834c8b128ac750fe338b53f775ee2a8784e8c443d49dfcb918c5b9d59b5492a1fe18743b8ba65b7d12514c
-
SSDEEP
1536:Wio8DVyYs7JZT0uPXn8OS6sIe3ekT5Z240jSZk:WkhyYIJZT0uPXn8OdsIe3c4Ql
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
enviofinal.kozow.com:5051
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
AnsyFelix
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
001-NOTIFICACION JUDICIAL.execmd.exedescription pid process target process PID 2972 set thread context of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2136 set thread context of 2928 2136 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\Quicktool.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
001-NOTIFICACION JUDICIAL.execmd.exeMSBuild.exepid process 2972 001-NOTIFICACION JUDICIAL.exe 2136 cmd.exe 2136 cmd.exe 2928 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
001-NOTIFICACION JUDICIAL.execmd.exepid process 2972 001-NOTIFICACION JUDICIAL.exe 2136 cmd.exe 2136 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2928 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 2928 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
001-NOTIFICACION JUDICIAL.execmd.exedescription pid process target process PID 2972 wrote to memory of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2972 wrote to memory of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2972 wrote to memory of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2972 wrote to memory of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2972 wrote to memory of 2136 2972 001-NOTIFICACION JUDICIAL.exe cmd.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe PID 2136 wrote to memory of 2928 2136 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\001-NOTIFICACION JUDICIAL.exe"C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\001-NOTIFICACION JUDICIAL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a7268739Filesize
776KB
MD58da9d472c4ab78a1d82d2b9d92d51c75
SHA1babe937f7f46fe592fd8637a936291467378e2e4
SHA2563d3dca76f27c703a2d70f0a54141a4b47dd5e07c7a35a82fb7fe4e1a76994129
SHA5123a78343a5ca39255259a1ef97678980c11d0abb2d60e2591c5e9e489d12f93b98d4ec37211de13b60659d1e424b46078516619e3cff09da6c35e6e86757aab50
-
memory/2136-18-0x0000000076F10000-0x00000000770B9000-memory.dmpFilesize
1.7MB
-
memory/2136-76-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2136-73-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2136-72-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2136-65-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2136-63-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2136-16-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2928-77-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2928-78-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2928-83-0x0000000004920000-0x0000000004960000-memory.dmpFilesize
256KB
-
memory/2928-82-0x0000000073B00000-0x00000000741EE000-memory.dmpFilesize
6.9MB
-
memory/2928-81-0x0000000004920000-0x0000000004960000-memory.dmpFilesize
256KB
-
memory/2928-80-0x0000000073B00000-0x00000000741EE000-memory.dmpFilesize
6.9MB
-
memory/2928-75-0x0000000072490000-0x00000000734F2000-memory.dmpFilesize
16.4MB
-
memory/2928-79-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2972-3-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2972-0-0x00000000001B0000-0x00000000002B8000-memory.dmpFilesize
1.0MB
-
memory/2972-2-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/2972-14-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB
-
memory/2972-4-0x0000000076F10000-0x00000000770B9000-memory.dmpFilesize
1.7MB
-
memory/2972-13-0x0000000074580000-0x00000000746F4000-memory.dmpFilesize
1.5MB