Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:27
Static task
static1
Behavioral task
behavioral1
Sample
a5565d3428290bfc6c4a9bcca68c15ea.exe
Resource
win7-20240220-en
General
-
Target
a5565d3428290bfc6c4a9bcca68c15ea.exe
-
Size
937KB
-
MD5
a5565d3428290bfc6c4a9bcca68c15ea
-
SHA1
28797c12ca5450fc854f773fb0c42414c0229fa8
-
SHA256
894a90bbfcbd16442d3b117f6b391c1f22b72d1aebafd0ff51a60df08b1e434d
-
SHA512
699f9c7266fc24b78bd44d026f7c4c98e613cde7b5d32efefa65dec1706ffac4f266b712760891cb45bcf6fae96880e9ce9b3246056778e78d682e32b333d7e4
-
SSDEEP
24576:uboifHo7t2xklCohhwbfIWyQZD/Og34dK:ubxfel3hyf1
Malware Config
Extracted
asyncrat
AWS | 3Losh
neq
goodone.loseyourip.com:6606
goodone.loseyourip.com:7707
goodone.loseyourip.com:8808
AsyncMutex_adnocxxs
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a5565d3428290bfc6c4a9bcca68c15ea.exedescription pid process target process PID 4264 set thread context of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 856 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a5565d3428290bfc6c4a9bcca68c15ea.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe Token: SeDebugPrivilege 856 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 856 RegAsm.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a5565d3428290bfc6c4a9bcca68c15ea.exedescription pid process target process PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 856 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe RegAsm.exe PID 4264 wrote to memory of 552 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe schtasks.exe PID 4264 wrote to memory of 552 4264 a5565d3428290bfc6c4a9bcca68c15ea.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5565d3428290bfc6c4a9bcca68c15ea.exe"C:\Users\Admin\AppData\Local\Temp\a5565d3428290bfc6c4a9bcca68c15ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC MINUTE /MO 14 /TN "AppTracker" /TR "C:\Users\Admin\AppData\Roaming\Ex64_Seeders\a5565d3428290bfc6c4a9bcca68c15ea.exe" /F2⤵
- Creates scheduled task(s)
PID:552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-12-0x0000000005690000-0x000000000569A000-memory.dmpFilesize
40KB
-
memory/856-18-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/856-17-0x0000000074CBE000-0x0000000074CBF000-memory.dmpFilesize
4KB
-
memory/856-16-0x0000000006820000-0x0000000006886000-memory.dmpFilesize
408KB
-
memory/856-4-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/856-6-0x0000000074CBE000-0x0000000074CBF000-memory.dmpFilesize
4KB
-
memory/856-15-0x0000000006780000-0x000000000681C000-memory.dmpFilesize
624KB
-
memory/856-9-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/856-10-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/856-11-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/4264-3-0x00000000014B0000-0x00000000014BA000-memory.dmpFilesize
40KB
-
memory/4264-8-0x00007FFF07970000-0x00007FFF08431000-memory.dmpFilesize
10.8MB
-
memory/4264-0-0x00007FFF07973000-0x00007FFF07975000-memory.dmpFilesize
8KB
-
memory/4264-2-0x00007FFF07970000-0x00007FFF08431000-memory.dmpFilesize
10.8MB
-
memory/4264-1-0x0000000000AA0000-0x0000000000B90000-memory.dmpFilesize
960KB