Analysis
-
max time kernel
1800s -
max time network
1181s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
18-05-2024 15:49
General
-
Target
Cozios-Imagelogger-main/cozios ImageLogger.exe
-
Size
81KB
-
MD5
23f472ba6e59df467b80af92f43eaf22
-
SHA1
7dd4433d3f059ea4a13454991f841c756aba3e47
-
SHA256
498b02baa4dee1f19d4d06e45e5eda8bbf386fcce695f07846ac5374c654e406
-
SHA512
ecaa60619bc59a546a8100518d5866fc993ae2be340454e6b1ea6a9dc05efa33946198a0e798488659c99c959d937cc63e09ce746d254bcab8a12c233a088468
-
SSDEEP
1536:DUxwcx/BVuCkmPMVhAz0M4zyAkIQH1by/4XOp4QzcQ633I6VclN:DU+cx/Bw/mPMVhA1BH1byl4Ql633IIY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
idjtweoowocnoy
-
delay
1
-
install
true
-
install_file
Cozios Imagelogger.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/LwwcrLg4
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cozios-Imagelogger-main\cozios ImageLogger.exe"C:\Users\Admin\AppData\Local\Temp\Cozios-Imagelogger-main\cozios ImageLogger.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.com"C:\Windows\system32\more.com"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.com"C:\Windows\system32\more.com"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5KB
MD558fdf7488d9acfa2b3494ed6c7056482
SHA102fa604e05633aab735b1a4e485646533879e065
SHA256ad75f8308c9b9aaf29094ab66d0d087f4ac2e3e18d9a67aa43220e9cf9f96dcb
SHA5128c6bd3bde867544bb0141cd7980ad3ab9709ad5e9466392c807599cad95e646a46dc8dcbb4daad66036bf63f095df11b7fb43394339edc3ee2671a77f347a8b2
-
Filesize
5KB
MD5359cc4072a6fc2a287a1ee5ac2ec881b
SHA1e17c26a90dbc57fd4632d848b405fc04d65cb4ea
SHA256220764a998fe6a153fdfb7da2812361a571b943f19b57d27fda769db1845b6e0
SHA512bdc90c69630da2a72ebc8fdbb5765a1064a36e99756a5f04add4b7991af6c68d5337c553ab6e506cf1ecdc838c56ffc1f21a523c67db3277c8096229bb04c4b6
-
Filesize
120KB
-
Filesize
272KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
472KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB