Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27-06-2024 16:26

General

  • Target

    spoofer.exe

  • Size

    63KB

  • MD5

    7cfe4eb5ed54dc0a2cd85a7d6aff4b77

  • SHA1

    ad24cedddc70fe94dc9bac7e05e3dd09e70ee48e

  • SHA256

    d1cd9f41af57c0632d8a5ae662ebda9c31b53021302dccac6963858c64ad59a3

  • SHA512

    1bf12ddb83d683a9841b228c609afa4f859d17d0c99247eeb638779452ceeb041eaba783c2d83bfe0a2e8b75452c053e6bac1a1d7803a48171aa2a17e4ec11c9

  • SSDEEP

    1536:SEXign23dVdu3kYUbZhPbDUZNLguUdpqKmY7:SZO23dyUYUbZhNGz

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

0.tcp.eu.ngrok.io13746:13746

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\spoofer.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1716
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:4724
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:2260
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
        PID:4904

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1716-0-0x00007FFBAF1F3000-0x00007FFBAF1F5000-memory.dmp

        Filesize

        8KB

      • memory/1716-1-0x0000000000030000-0x0000000000046000-memory.dmp

        Filesize

        88KB

      • memory/1716-2-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

        Filesize

        10.8MB

      • memory/1716-3-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

        Filesize

        10.8MB

      • memory/1716-4-0x00007FFBAF1F3000-0x00007FFBAF1F5000-memory.dmp

        Filesize

        8KB

      • memory/1716-5-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

        Filesize

        10.8MB

      • memory/1716-6-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

        Filesize

        10.8MB