Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-04-2024 06:58

General

  • Target

    12de70d06ed65680914d061347ac1f95.exe

  • Size

    89KB

  • MD5

    12de70d06ed65680914d061347ac1f95

  • SHA1

    14023e1ed46236cbfb463ddccd6345caa3c14d54

  • SHA256

    46b90cce656efe63bc33b585581c2cafd25778f2854a334f0421d219ed17b339

  • SHA512

    7d6a20b0e9d6c5db0177e08f197f7858aa8000097c5eb2fa7a2b3d2181fefb53760efacd7fcba32d481193eee547162ac22b08b8e8777b68fc1597dec12db67f

  • SSDEEP

    1536:EGjb5BKhaUxo6TRMinLvIbzV6A2SYzEOV4c7rei1:EGjb5IJxZTLnL4aSY4OVDui

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

103.249.112.118:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\12de70d06ed65680914d061347ac1f95.exe
    "C:\Users\Admin\AppData\Local\Temp\12de70d06ed65680914d061347ac1f95.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\system32\SCHtAsKs.EXe
      "SCHtAsKs.EXe" /create /tn WindowsUpdates /TR 'C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE' /du 9999:59 /sc daily /ri 1
      2⤵
      • Creates scheduled task(s)
      PID:2188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2464
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {FE7E3FB8-D6DF-4CB2-A01D-4F8560B774A3} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
      C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1036
    • C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
      C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE

    Filesize

    89KB

    MD5

    12de70d06ed65680914d061347ac1f95

    SHA1

    14023e1ed46236cbfb463ddccd6345caa3c14d54

    SHA256

    46b90cce656efe63bc33b585581c2cafd25778f2854a334f0421d219ed17b339

    SHA512

    7d6a20b0e9d6c5db0177e08f197f7858aa8000097c5eb2fa7a2b3d2181fefb53760efacd7fcba32d481193eee547162ac22b08b8e8777b68fc1597dec12db67f

  • memory/1036-44-0x000007FEF47B0000-0x000007FEF519C000-memory.dmp

    Filesize

    9.9MB

  • memory/1036-43-0x0000000000AE0000-0x0000000000AFA000-memory.dmp

    Filesize

    104KB

  • memory/2084-49-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2084-48-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2084-47-0x00000000003F0000-0x000000000040A000-memory.dmp

    Filesize

    104KB

  • memory/2236-0-0x0000000000130000-0x000000000014A000-memory.dmp

    Filesize

    104KB

  • memory/2236-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2236-3-0x000000001AD00000-0x000000001AD80000-memory.dmp

    Filesize

    512KB

  • memory/2236-4-0x00000000002C0000-0x00000000002FC000-memory.dmp

    Filesize

    240KB

  • memory/2236-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2236-13-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2464-14-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-16-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-17-0x0000000073EE0000-0x00000000745CE000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-18-0x0000000004DD0000-0x0000000004E10000-memory.dmp

    Filesize

    256KB

  • memory/2464-19-0x0000000077130000-0x0000000077131000-memory.dmp

    Filesize

    4KB

  • memory/2464-37-0x0000000073EE0000-0x00000000745CE000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-38-0x0000000004DD0000-0x0000000004E10000-memory.dmp

    Filesize

    256KB

  • memory/2464-11-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2464-9-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-8-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-7-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2464-6-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB