Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2024 11:14

General

  • Target

    XSolaraBoostraper.exe

  • Size

    897KB

  • MD5

    9726caf5c97e4fa4729e053b90aaf022

  • SHA1

    ecdcfe0c4160de078339c46ed18ae224a6e4e95b

  • SHA256

    983a63b1512fde7fa38311ecffb3c95ee6c65a9cf1146da42d80d22b55ea6507

  • SHA512

    13461b63c230c2cdd913296e9a687380f8d17d2f94ef1f5067b9a5341c16ded897faaa6646e7d703aa81fb3e29e0dd62a9992f59dfdeda161635ff660d6fd29b

  • SSDEEP

    12288:L4VR00Rn1mzgHpbzEu8AgpQojA1j855xU9pHIRxSNN:L9O1mzgH385QojA1j855xSHI

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

carolina-reverse.gl.at.ply.gg:34609

Mutex

T2iVdWpLQAd2

Attributes
  • delay

    3

  • install

    true

  • install_file

    SolaraUpdateHoster.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XSolaraBoostraper.exe
    "C:\Users\Admin\AppData\Local\Temp\XSolaraBoostraper.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\DLLHOST.EXE
      "C:\Users\Admin\AppData\Local\Temp\DLLHOST.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SolaraUpdateHoster" /tr '"C:\Users\Admin\AppData\Roaming\SolaraUpdateHoster.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "SolaraUpdateHoster" /tr '"C:\Users\Admin\AppData\Roaming\SolaraUpdateHoster.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2776
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BCA.tmp.bat""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:888
        • C:\Users\Admin\AppData\Roaming\SolaraUpdateHoster.exe
          "C:\Users\Admin\AppData\Roaming\SolaraUpdateHoster.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:300
    • C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE
      "C:\Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\SysWOW64\msiexec.exe
        "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 1564
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2788
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:284
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 1CA0125E8199866971F351DB27B1CE03
      2⤵
      • Loads dropped DLL
      PID:2040
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BB52325938AA245C85DCE9A4666F3115
      2⤵
      • Loads dropped DLL
      PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    cf16eef62236eac156cbe2960ecf06e1

    SHA1

    a50341fcb4c7cb0ad827fe0185e57ee68536f9e4

    SHA256

    5b18b3d9b673401d775630a5abf9dabcd1aba916c8ae903e3073d13ca1cc6fe0

    SHA512

    7482e5f3d8fe4fdfce18d29fef2a42cf1c72d35fd2c0439aca30a6599d332b9342f5bb5f238f6ef880f53141b0b204de2ac80357e23ddeae0f1bb6f9c731217d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    062b6606b5d6fc33cbe3b7505d571c04

    SHA1

    f6eab92b1700c239e63c4a3cfa9bf32d3957d7b5

    SHA256

    2ae7502c49ddea8c2163f67c6a22e950a43871374efd33817ac76636334ec7fa

    SHA512

    ef4c6cdcca8589b4e811f06ab689dada40575e556ae11a420560069919bf62c8abf801b2185d02ceaa353f7090f6135aa5d35f643be28e05b7df8c76c8cd9bc3

  • C:\Users\Admin\AppData\Local\Temp\Tar1A8A.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
    Filesize

    30.1MB

    MD5

    0e4e9aa41d24221b29b19ba96c1a64d0

    SHA1

    231ade3d5a586c0eb4441c8dbfe9007dc26b2872

    SHA256

    5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

    SHA512

    e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

  • C:\Users\Admin\AppData\Local\Temp\tmp1BCA.tmp.bat
    Filesize

    162B

    MD5

    d6c6ccee9561c48c16b3ea7f980d3db1

    SHA1

    a61e943f64d7622001294768c88c24e093795505

    SHA256

    678638abe3a0d55f9173fc75405c68624a554f57d2d55d43ed7a1c90434f805b

    SHA512

    d82858e37df15598ebb45335ec5d1d4850a2e034084a71882dd9315f8fb4cbfe4e140e61dd7a52f8cb5e9605d2d92349e1f26692d6a1e4b271f96cfe54472ec8

  • C:\Windows\Installer\MSI2B0C.tmp
    Filesize

    122KB

    MD5

    9fe9b0ecaea0324ad99036a91db03ebb

    SHA1

    144068c64ec06fc08eadfcca0a014a44b95bb908

    SHA256

    e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

    SHA512

    906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

  • C:\Windows\Installer\MSI2BAA.tmp
    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • \Users\Admin\AppData\Local\Temp\DLLHOST.EXE
    Filesize

    47KB

    MD5

    44359c5e869c44100cfe1dd316d4f0a2

    SHA1

    26f8aed6286f69c9d9884ffa1c81d931b77e94c1

    SHA256

    503a126804af61976611e4fa3f4991a2e3c6741029a6ac8aa2c5411a192f2115

    SHA512

    e3edb5700da4b86ee0ff0e5ba2aff9b2fc2b5107c449cef301c8a6117eaef68ef7b2778d20e7c03a80a44023638faf5a3f5a8536f09996bb1e88fef4ea641210

  • \Users\Admin\AppData\Local\Temp\SOLARABOOTSTRAPPER.EXE
    Filesize

    797KB

    MD5

    36b62ba7d1b5e149a2c297f11e0417ee

    SHA1

    ce1b828476274375e632542c4842a6b002955603

    SHA256

    8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c

    SHA512

    fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94

  • memory/300-69-0x00000000012C0000-0x00000000012D2000-memory.dmp
    Filesize

    72KB

  • memory/300-147-0x0000000000B90000-0x0000000000BF4000-memory.dmp
    Filesize

    400KB

  • memory/2168-15-0x00000000000D0000-0x00000000000E2000-memory.dmp
    Filesize

    72KB

  • memory/2168-14-0x00000000743FE000-0x00000000743FF000-memory.dmp
    Filesize

    4KB

  • memory/2472-17-0x00000000743F0000-0x0000000074ADE000-memory.dmp
    Filesize

    6.9MB

  • memory/2472-16-0x0000000000DA0000-0x0000000000E6E000-memory.dmp
    Filesize

    824KB

  • memory/2472-146-0x00000000743F0000-0x0000000074ADE000-memory.dmp
    Filesize

    6.9MB