Malware Analysis Report

2024-10-19 06:55

Sample ID 240526-fcv8esfd4t
Target f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047
SHA256 f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047
Tags
rat asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047

Threat Level: Known bad

The file f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047 was found to be: Known bad.

Malicious Activity Summary

rat asyncrat

Asyncrat family

Contains code to disable Windows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Detects file containing reversed ASEP Autorun registry keys

AsyncRat

Detects executables containing artifacts associated with disabling Widnows Defender

Detects Windows executables referencing non-Windows User-Agents

Async RAT payload

Detects file containing reversed ASEP Autorun registry keys

Detects Windows executables referencing non-Windows User-Agents

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Detects executables containing artifacts associated with disabling Widnows Defender

Unsigned PE

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-26 04:44

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 04:44

Reported

2024-05-26 04:46

Platform

win7-20240508-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe"

Signatures

AsyncRat

rat asyncrat

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe

"C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 corporation.warzonedns.com udp

Files

memory/3008-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

memory/3008-1-0x0000000000090000-0x00000000000C0000-memory.dmp

memory/3008-2-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

memory/3008-3-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

memory/3008-4-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 04:44

Reported

2024-05-26 04:46

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe"

Signatures

AsyncRat

rat asyncrat

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe

"C:\Users\Admin\AppData\Local\Temp\f349c54c94b3edd91fb10d43b7aed1d98e685145856eae9fad65275ce3511047.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.212.202:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 137.71.105.51.in-addr.arpa udp
US 8.8.8.8:53 corporation.warzonedns.com udp
US 8.8.8.8:53 corporation.warzonedns.com udp

Files

memory/648-0-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmp

memory/648-1-0x0000000000BF0000-0x0000000000C20000-memory.dmp

memory/648-2-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

memory/648-4-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmp

memory/648-5-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp