Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    449s
  • max time network
    451s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    26/04/2024, 22:54

General

  • Target

    CITACION DEMANDA/04 CITACION DEMANDA.exe

  • Size

    446KB

  • MD5

    485008b43f0edceba0e0d3ca04bc1c1a

  • SHA1

    55ae8f105af415bb763d1b87f6572f078052877c

  • SHA256

    12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

  • SHA512

    402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

  • SSDEEP

    12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

melo2024.kozow.com:8000

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    AnsyFelix

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\04 CITACION DEMANDA.exe
    "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\04 CITACION DEMANDA.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp.bat""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:980
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            5⤵
            • Delays execution with timeout.exe
            PID:464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8fb2e900

    Filesize

    776KB

    MD5

    9dc62be569ee54e27be46662d2b39722

    SHA1

    5b46f561d2f2e815d67a0d1daf3819cee86f24cd

    SHA256

    1128dc9a0faba9b666ce5fd945bcb5aa74aad122ad22e10ebc2899ef58bf75c5

    SHA512

    62150747d6a778508af83340f8209cfe2972beca7ddef636c8b7b4547ff2f830420942e3a9397f1aeea56d82f3f0c93d933c486388069fa262470c56b245bde7

  • C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp.bat

    Filesize

    171B

    MD5

    e574e6b66c7deb64f07362e7ecdb6b35

    SHA1

    702ffa1b346071142792f5ab121fa81a354471bd

    SHA256

    868df83104a7ca3679e7e70cd76fb4a12ca8a0de64ff438e1f8c710a7cce7500

    SHA512

    26dbdabd99a8a5d79d1b5c90ba467897caf154712fb4ba69e6d1c4e2a3988ec263612150680314f5dcfbeaa171f4a54554475edc53f4bd4bafcd61e0eb1e22f5

  • memory/632-0-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/632-1-0x00007FF9E8C70000-0x00007FF9E8E65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-7-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/632-8-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-12-0x00007FF9E8C70000-0x00007FF9E8E65000-memory.dmp

    Filesize

    2.0MB

  • memory/3968-14-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-16-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-18-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-19-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-22-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/3968-10-0x0000000074730000-0x00000000748AB000-memory.dmp

    Filesize

    1.5MB

  • memory/4532-26-0x0000000072410000-0x0000000072BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-32-0x00000000057C0000-0x0000000005826000-memory.dmp

    Filesize

    408KB

  • memory/4532-27-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/4532-28-0x0000000005880000-0x0000000005E24000-memory.dmp

    Filesize

    5.6MB

  • memory/4532-29-0x0000000005470000-0x0000000005502000-memory.dmp

    Filesize

    584KB

  • memory/4532-30-0x0000000005420000-0x000000000542A000-memory.dmp

    Filesize

    40KB

  • memory/4532-31-0x00000000060A0000-0x000000000613C000-memory.dmp

    Filesize

    624KB

  • memory/4532-25-0x0000000000B70000-0x0000000000B86000-memory.dmp

    Filesize

    88KB

  • memory/4532-33-0x0000000006570000-0x0000000006672000-memory.dmp

    Filesize

    1.0MB

  • memory/4532-34-0x0000000072410000-0x0000000072BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-35-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/4532-36-0x0000000006E00000-0x0000000006E76000-memory.dmp

    Filesize

    472KB

  • memory/4532-37-0x0000000006D80000-0x0000000006DA6000-memory.dmp

    Filesize

    152KB

  • memory/4532-38-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

    Filesize

    120KB

  • memory/4532-42-0x0000000072410000-0x0000000072BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-21-0x0000000072BC0000-0x0000000073E14000-memory.dmp

    Filesize

    18.3MB