Malware Analysis Report

2024-09-22 06:59

Sample ID 240620-xbfvsawdkn
Target Dllhost.exe
SHA256 b324d1b19e6c6eff0efb46fbee13d56a71ecdf1f3891a30f3435ba671adf07f0
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b324d1b19e6c6eff0efb46fbee13d56a71ecdf1f3891a30f3435ba671adf07f0

Threat Level: Known bad

The file Dllhost.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

AsyncRat

Async RAT payload

Asyncrat family

Async RAT payload

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 18:40

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 18:40

Reported

2024-06-20 18:43

Platform

win11-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1592 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1592 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3900 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3900 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3900 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1592 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 1592 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 1592 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dllhost.exe

"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllhost" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8B48.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "dllhost" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.exe"'

C:\Users\Admin\AppData\Roaming\dllhost.exe

"C:\Users\Admin\AppData\Roaming\dllhost.exe"

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.tcp.eu.ngrok udp

Files

memory/2436-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

memory/2436-1-0x0000000000880000-0x0000000000892000-memory.dmp

memory/2436-2-0x00000000751F0000-0x00000000759A1000-memory.dmp

memory/2436-3-0x00000000052E0000-0x0000000005346000-memory.dmp

memory/2436-4-0x0000000005780000-0x000000000581C000-memory.dmp

memory/2436-9-0x00000000751F0000-0x00000000759A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8B48.tmp.bat

MD5 8d2a88f6de9fdca789c4843f2bd1aa99
SHA1 9274d676172c76fad9ffe1720574acc7309275f2
SHA256 c8e7887b91d832fc0aeed742cdb2e336b05d9a43f86e411d77e5e80ceaaf4f6a
SHA512 a6e6f2ad2e63d3636d22deaf87ff16c1e113358a7007bb72b39c82d7ae5cd44bba7fa0c44e024e8d1f439151e371172bad3c87eb920724d9b7542d3e54e442a8

C:\Users\Admin\AppData\Roaming\dllhost.exe

MD5 87bc62c9412b158944dcd660b65c1fc9
SHA1 bf2541d0537f58440738c9b6a8f43b3da95588cc
SHA256 b324d1b19e6c6eff0efb46fbee13d56a71ecdf1f3891a30f3435ba671adf07f0
SHA512 9d6b2c0b8e1768307b4a7f5ca4b6b6f5720b1882271ba666ff1e24b8560b77c47b478122abec5b6c660eb7acb74ec46818dc2ba373fdad999b1623e170ee82fd

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllhost.exe.log

MD5 fece27917067365b631bc648c66fe066
SHA1 f12c84b1c2b1296091ee06e8654c7065d22cbb44
SHA256 93e03593374ce40bc5d4c57832ebe96d3a6a532766eb6385f568a0383b426d10
SHA512 9b502a6d46b82ccc2c8aff650de664299f0131a82480eb9cec701546e9cd7f1647c0665014035c19da80a6cab267cf896645af827ecdd95287a70994c1ecb662

memory/976-15-0x0000000075140000-0x00000000758F1000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 9a7af7f1f08f7de9da3ba647286ee5a6
SHA1 d7a23961ba5f8c4242a03f20686ff516c2ae432c
SHA256 dddc3d322b46ec53927c26326a4f4d573dec131fbe668450f984c91c3104a08b
SHA512 64b0d94e68aa2d0ee9d02f170de6989f5255c5c57d05dffbf4dbbe012dae43a6f4dbd59c6a85fd2621fb84ae7f4cdf486a089b90e3e6c4fce1b152ba5aa6ba58

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 35745802ec2865acb4c60e651e5a8620
SHA1 f10c746a71c2741790aa3f5160ea7d9be1a1920a
SHA256 ef386e977e9fcfc811f2710d0d630e23e2278cf9811770da0c2f10f3965b7a63
SHA512 0031f739cafa1089dc655a3509bc215fc900c20734507a1b0b69f1ad1567fb2fe4af725360cf952a4689e89973bbd59a53ea6ff8bd6c4c67b9e732f66f14a42f

memory/976-36-0x0000000075140000-0x00000000758F1000-memory.dmp