Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACION DEMANDA/01Notificacion Demanda.exe
Resource
win7-20240221-en
General
-
Target
NOTIFICACION DEMANDA/01Notificacion Demanda.exe
-
Size
2.3MB
-
MD5
5d52ef45b6e5bf144307a84c2af1581b
-
SHA1
414a899ec327d4a9daa53983544245b209f25142
-
SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616
-
SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48
-
SSDEEP
49152:DzO+g39FbI0eQf/Z3CarWedoYAmXviDTMtT2wkqN5K:DzO19Fnf/hdoYAm9ZkqN5K
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
dcrat13.duckdns.org:3013
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
01Notificacion Demanda.execmd.exedescription pid process target process PID 2308 set thread context of 3304 2308 01Notificacion Demanda.exe cmd.exe PID 3304 set thread context of 1688 3304 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\BMObeaconv1.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
01Notificacion Demanda.execmd.exeMSBuild.exepid process 2308 01Notificacion Demanda.exe 2308 01Notificacion Demanda.exe 3304 cmd.exe 3304 cmd.exe 1688 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
01Notificacion Demanda.execmd.exepid process 2308 01Notificacion Demanda.exe 3304 cmd.exe 3304 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1688 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1688 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
01Notificacion Demanda.execmd.exedescription pid process target process PID 2308 wrote to memory of 3304 2308 01Notificacion Demanda.exe cmd.exe PID 2308 wrote to memory of 3304 2308 01Notificacion Demanda.exe cmd.exe PID 2308 wrote to memory of 3304 2308 01Notificacion Demanda.exe cmd.exe PID 2308 wrote to memory of 3304 2308 01Notificacion Demanda.exe cmd.exe PID 3304 wrote to memory of 1688 3304 cmd.exe MSBuild.exe PID 3304 wrote to memory of 1688 3304 cmd.exe MSBuild.exe PID 3304 wrote to memory of 1688 3304 cmd.exe MSBuild.exe PID 3304 wrote to memory of 1688 3304 cmd.exe MSBuild.exe PID 3304 wrote to memory of 1688 3304 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA\01Notificacion Demanda.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA\01Notificacion Demanda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b523763dFilesize
777KB
MD5864fa8f41db1b807b1d77bc213b8dc57
SHA16324e91700bfe647a66c8ecaba0eeb13eb4234ab
SHA256f18960144d86f44e1e65fbfc464f50cd45b886036272724cc8c0a2da21551d36
SHA512820b79b872c7683ab9f84366f5136aa515c964c8f05c0e4df7b8f5dd62cb85e75ac79836a42d094fe64104fc0e82c6f2dd128c4ecf1c3066759ceea40d8c5da5
-
memory/1688-47-0x0000000072C70000-0x0000000073420000-memory.dmpFilesize
7.7MB
-
memory/1688-46-0x0000000072C7E000-0x0000000072C7F000-memory.dmpFilesize
4KB
-
memory/1688-45-0x0000000005500000-0x0000000005566000-memory.dmpFilesize
408KB
-
memory/1688-44-0x0000000006270000-0x000000000630C000-memory.dmpFilesize
624KB
-
memory/1688-41-0x00000000051A0000-0x00000000051AA000-memory.dmpFilesize
40KB
-
memory/1688-40-0x00000000051B0000-0x0000000005242000-memory.dmpFilesize
584KB
-
memory/1688-39-0x0000000005580000-0x0000000005B24000-memory.dmpFilesize
5.6MB
-
memory/1688-38-0x0000000072C70000-0x0000000073420000-memory.dmpFilesize
7.7MB
-
memory/1688-37-0x0000000000900000-0x0000000000916000-memory.dmpFilesize
88KB
-
memory/1688-36-0x0000000072C7E000-0x0000000072C7F000-memory.dmpFilesize
4KB
-
memory/1688-32-0x0000000073420000-0x0000000074674000-memory.dmpFilesize
18.3MB
-
memory/2308-19-0x0000000050120000-0x000000005030D000-memory.dmpFilesize
1.9MB
-
memory/2308-0-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/2308-1-0x00007FFEB5430000-0x00007FFEB5625000-memory.dmpFilesize
2.0MB
-
memory/2308-10-0x0000000074992000-0x0000000074994000-memory.dmpFilesize
8KB
-
memory/2308-11-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/2308-14-0x0000000000400000-0x0000000000698000-memory.dmpFilesize
2.6MB
-
memory/2308-12-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/2308-20-0x0000000050310000-0x0000000050349000-memory.dmpFilesize
228KB
-
memory/2308-15-0x0000000050000000-0x0000000050116000-memory.dmpFilesize
1.1MB
-
memory/2308-16-0x0000000059800000-0x000000005986E000-memory.dmpFilesize
440KB
-
memory/2308-17-0x0000000057000000-0x000000005703F000-memory.dmpFilesize
252KB
-
memory/2308-18-0x0000000057800000-0x0000000057812000-memory.dmpFilesize
72KB
-
memory/3304-29-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-21-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-33-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-30-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-27-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-25-0x0000000074980000-0x0000000074AFB000-memory.dmpFilesize
1.5MB
-
memory/3304-23-0x00007FFEB5430000-0x00007FFEB5625000-memory.dmpFilesize
2.0MB