Analysis
-
max time kernel
129s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 15:24
Behavioral task
behavioral1
Sample
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe
Resource
win7-20231129-en
General
-
Target
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe
-
Size
74KB
-
MD5
7ac0adf482250172280defec7a7054da
-
SHA1
20a25f0da68c309d062c4628ead8b6f377ac7969
-
SHA256
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5
-
SHA512
d03d033b931f3d39f95a1ec1cdc7d9014783f11b2438c265dd72c0bc34f9d5ced534a38c7c1c88ff930868fd9cf60521dd556b5c486c5cf364f798f39215a1aa
-
SSDEEP
1536:WUxQcxHCapCtGPMVCe9VdQuDI6H1bf/yBZUu7QzciLVclN:WUOcxHCoeGPMVCe9VdQsH1bfqvUwQzBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
66.235.168.242:4449
scgofjarww
-
delay
1
-
install
true
-
install_file
Loader.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Loader.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe -
Executes dropped EXE 1 IoCs
Processes:
Loader.exepid process 4900 Loader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4764 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exeLoader.exepid process 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe 4900 Loader.exe 4900 Loader.exe 4900 Loader.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exeLoader.exedescription pid process Token: SeDebugPrivilege 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe Token: SeDebugPrivilege 4900 Loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Loader.exepid process 4900 Loader.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.execmd.execmd.exedescription pid process target process PID 1092 wrote to memory of 5108 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe cmd.exe PID 1092 wrote to memory of 5108 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe cmd.exe PID 1092 wrote to memory of 4816 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe cmd.exe PID 1092 wrote to memory of 4816 1092 3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe cmd.exe PID 5108 wrote to memory of 4060 5108 cmd.exe schtasks.exe PID 5108 wrote to memory of 4060 5108 cmd.exe schtasks.exe PID 4816 wrote to memory of 4764 4816 cmd.exe timeout.exe PID 4816 wrote to memory of 4764 4816 cmd.exe timeout.exe PID 4816 wrote to memory of 4900 4816 cmd.exe Loader.exe PID 4816 wrote to memory of 4900 4816 cmd.exe Loader.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe"C:\Users\Admin\AppData\Local\Temp\3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loader" /tr '"C:\Users\Admin\AppData\Roaming\Loader.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Loader" /tr '"C:\Users\Admin\AppData\Roaming\Loader.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4873.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Loader.exe"C:\Users\Admin\AppData\Roaming\Loader.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4873.tmp.batFilesize
150B
MD5ef1e276ed5caa47d53622ad566202c7f
SHA17af8c2daf912f8cff0946eecd1bc6d6c1cf30d94
SHA256f1eeefb0b8fc599b5c92a9d5f7323fb8e8169a0c38f4f820b30febe38565b5bf
SHA512ea75a8254ef0b633fd7959c987a47c11bce7dc15bae58406ea2310eba18f8e44a17b5d79b7644dfa33221ece5913d70fa25a6ac2891cc94b7653546b2dae2fe7
-
C:\Users\Admin\AppData\Roaming\Loader.exeFilesize
74KB
MD57ac0adf482250172280defec7a7054da
SHA120a25f0da68c309d062c4628ead8b6f377ac7969
SHA2563caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5
SHA512d03d033b931f3d39f95a1ec1cdc7d9014783f11b2438c265dd72c0bc34f9d5ced534a38c7c1c88ff930868fd9cf60521dd556b5c486c5cf364f798f39215a1aa
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
memory/1092-0-0x00007FF815843000-0x00007FF815845000-memory.dmpFilesize
8KB
-
memory/1092-1-0x00000000002E0000-0x00000000002F8000-memory.dmpFilesize
96KB
-
memory/1092-3-0x00007FF815840000-0x00007FF816301000-memory.dmpFilesize
10.8MB
-
memory/1092-8-0x00007FF815840000-0x00007FF816301000-memory.dmpFilesize
10.8MB