Analysis
-
max time kernel
119s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
Resource
win10v2004-20240426-en
General
-
Target
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
-
Size
1.8MB
-
MD5
dd256157a85a12405cbdf789af1b2442
-
SHA1
215b9612eec327982a956ada1c5c9ca0cb934b0b
-
SHA256
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d
-
SHA512
4e6b8dcc6cf00c85d3a68a412555e370a5d63ee480594e7a7ee6f8289e2873ea4b2860d6e5a7e3bd77ea1c079132ecbf9010bb6e47683c6c49ac640357fee2f3
-
SSDEEP
49152:P1opHluallLeIfGpD+ePfGaBbVoJLshVGbdMeaLaf:N2HluaDp7WmeJaf
Malware Config
Extracted
asyncrat
1.0.7
ORO-BENDITOS 2
krakenstudio061Q.casacam.net:8002
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Umunu\\uOperna.exe" 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exedescription pid process target process PID 2416 set thread context of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
csc.exedescription pid process Token: SeDebugPrivilege 1160 csc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exedescription pid process target process PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe PID 2416 wrote to memory of 1160 2416 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe csc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe"C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-7-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1160-3-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1160-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1160-5-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1160-9-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1160-11-0x000000007472E000-0x000000007472F000-memory.dmpFilesize
4KB
-
memory/1160-12-0x0000000074720000-0x0000000074E0E000-memory.dmpFilesize
6.9MB
-
memory/1160-30-0x000000007472E000-0x000000007472F000-memory.dmpFilesize
4KB
-
memory/1160-31-0x0000000074720000-0x0000000074E0E000-memory.dmpFilesize
6.9MB
-
memory/2416-2-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2416-1-0x000000000040C000-0x0000000000425000-memory.dmpFilesize
100KB
-
memory/2416-0-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2416-10-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB