Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
26/04/2024, 01:37
General
- Target dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe
- Size 2.2MB
- Sample240426-b1992aha41
- SHA256 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
tomx.brasilia.me:6606
-
tomx.brasilia.me:7707
-
tomx.brasilia.me:8808
-
91.92.253.249:6606
-
91.92.253.249:7707
-
91.92.253.249:8808
-
vWKJAJDsDf09
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Detects file containing reversed ASEP Autorun registry keys 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe"C:\Users\Admin\AppData\Local\Temp\dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AeQBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAZABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB0ACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Hzoynygqzv.exe"C:\Users\Admin\AppData\Local\Hzoynygqzv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\IDM_6.4x_Crack_v18.1.exe"C:\Users\Admin\AppData\Local\IDM_6.4x_Crack_v18.1.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Hzoynygqzv.exe
IDM_6.4x_Crack_v18.1.exe
__PSScriptPolicyTest_mqt3vxjt.fji.ps1
memory/3092-84-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-72-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-23-0x00000000050A0000-0x00000000052C0000-memory.dmp
memory/3092-26-0x0000000005870000-0x0000000005E14000-memory.dmp
memory/3092-34-0x0000000005380000-0x0000000005412000-memory.dmp
memory/3092-40-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-4961-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/3092-4956-0x0000000006220000-0x0000000006274000-memory.dmp
memory/3092-4955-0x00000000057B0000-0x00000000057FC000-memory.dmp
memory/3092-4954-0x0000000005750000-0x00000000057AC000-memory.dmp
memory/3092-4953-0x0000000005560000-0x0000000005561000-memory.dmp
memory/3092-4952-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/3092-2081-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/3092-41-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-123-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-119-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-44-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-46-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-48-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-50-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-52-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-54-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-56-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-58-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-117-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-60-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-94-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-64-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-66-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-68-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-70-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-88-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-74-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-76-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-78-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-80-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-82-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-18-0x00000000004A0000-0x00000000006CE000-memory.dmp
memory/3092-19-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/3092-86-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-109-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-92-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-115-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-112-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/3092-90-0x00000000050A0000-0x00000000052BA000-memory.dmp
memory/4048-4960-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4048-4967-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/4048-4966-0x0000000005660000-0x00000000056FC000-memory.dmp
memory/4048-4963-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/4048-4962-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/4464-255-0x0000000007D10000-0x0000000007D24000-memory.dmp
memory/4464-266-0x0000000007DE0000-0x0000000007DE8000-memory.dmp
memory/4464-61-0x0000000006760000-0x000000000677E000-memory.dmp
memory/4464-42-0x00000000062B0000-0x0000000006604000-memory.dmp
memory/4464-120-0x00000000080E0000-0x000000000875A000-memory.dmp
memory/4464-121-0x0000000007AA0000-0x0000000007ABA000-memory.dmp
memory/4464-35-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/4464-131-0x0000000007B10000-0x0000000007B1A000-memory.dmp
memory/4464-140-0x0000000007D30000-0x0000000007DC6000-memory.dmp
memory/4464-150-0x0000000007CA0000-0x0000000007CB1000-memory.dmp
memory/4464-97-0x00000000701C0000-0x000000007020C000-memory.dmp
memory/4464-263-0x0000000007DF0000-0x0000000007E0A000-memory.dmp
memory/4464-246-0x0000000007D00000-0x0000000007D0E000-memory.dmp
memory/4464-63-0x0000000006820000-0x000000000686C000-memory.dmp
memory/4464-286-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/4464-28-0x00000000060D0000-0x0000000006136000-memory.dmp
memory/4464-27-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/4464-25-0x0000000003140000-0x0000000003150000-memory.dmp
memory/4464-24-0x0000000003140000-0x0000000003150000-memory.dmp
memory/4464-22-0x0000000073900000-0x00000000740B0000-memory.dmp
memory/4464-21-0x0000000005930000-0x0000000005F58000-memory.dmp
memory/4464-20-0x00000000031A0000-0x00000000031D6000-memory.dmp
memory/4464-95-0x0000000007710000-0x0000000007742000-memory.dmp
memory/4464-96-0x000000007F6F0000-0x000000007F700000-memory.dmp
memory/4464-110-0x0000000003140000-0x0000000003150000-memory.dmp
memory/4464-113-0x0000000007750000-0x00000000077F3000-memory.dmp
memory/4464-108-0x0000000006D20000-0x0000000006D3E000-memory.dmp