Analysis

  • max time kernel
    1790s
  • max time network
    1799s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-06-2024 21:53

General

  • Target

    SMS-Bomber.exe

  • Size

    47KB

  • MD5

    4a56c6e517888a3524999e18e6d7740b

  • SHA1

    3781d9472264ca9af471cdc80ffc87c34134c112

  • SHA256

    44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706

  • SHA512

    0b7c6c0f82b19b20632d8a8d8c93a772f175acc0bf1c9ff1a57f5e731f739806b98663f824a7ec07843cad2fe69376bba57967587a86e5dfe4dc890df334ba4e

  • SSDEEP

    768:Euzkx3FTkYwt9y4gWUOlKnjamo2q8ayby6FXbWPI8rQ9Hyfw+0bF3HFZBzUccTUW:EuS3FTHHe2Gy+6Z78rQ9HGWbF3T9U5+Q

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

0UfuvIZfaBv8

Attributes
  • delay

    3

  • install

    true

  • install_file

    api.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/aDAYnLv4

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SMS-Bomber.exe
    "C:\Users\Admin\AppData\Local\Temp\SMS-Bomber.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4B9F.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4528
      • C:\Users\Admin\AppData\Roaming\api.exe
        "C:\Users\Admin\AppData\Roaming\api.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4B9F.tmp.bat

    Filesize

    147B

    MD5

    d3083d7da0e60c90af5ed5f108e7624b

    SHA1

    e8e89fef2a09a12cf0ae5569786e2025cf61fb1b

    SHA256

    f957ee2d070b5fd1184d4bcaa333424a162d6606cafa18fc99af36f22d124fb4

    SHA512

    7ce6e6e78d31ce1c38e3ed43709760a0f5e350efc1dc96210e8c7cacb95032f7a9464e345b4ac41c553e034ae299ab471d761fdef3ee8c4aa4361925160dd40b

  • C:\Users\Admin\AppData\Roaming\api.exe

    Filesize

    47KB

    MD5

    4a56c6e517888a3524999e18e6d7740b

    SHA1

    3781d9472264ca9af471cdc80ffc87c34134c112

    SHA256

    44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706

    SHA512

    0b7c6c0f82b19b20632d8a8d8c93a772f175acc0bf1c9ff1a57f5e731f739806b98663f824a7ec07843cad2fe69376bba57967587a86e5dfe4dc890df334ba4e

  • memory/2632-1-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

  • memory/2632-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

    Filesize

    4KB

  • memory/2632-2-0x0000000074CA0000-0x0000000075451000-memory.dmp

    Filesize

    7.7MB

  • memory/2632-3-0x00000000055D0000-0x000000000566C000-memory.dmp

    Filesize

    624KB

  • memory/2632-8-0x0000000074CA0000-0x0000000075451000-memory.dmp

    Filesize

    7.7MB

  • memory/2732-13-0x0000000074BF0000-0x00000000753A1000-memory.dmp

    Filesize

    7.7MB

  • memory/2732-14-0x0000000074BF0000-0x00000000753A1000-memory.dmp

    Filesize

    7.7MB