Analysis

  • max time kernel
    139s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 03:46

General

  • Target

    2024-06-28_15580dae4a38e0ee4581c1cb3b1d98eb_asyncrat_icedid.exe

  • Size

    1.9MB

  • MD5

    15580dae4a38e0ee4581c1cb3b1d98eb

  • SHA1

    493a4b1a0207ea640efed703e4680ca4a73dfab9

  • SHA256

    859e715607c56783ca86527dc6e6696d741030b10d9c17a911ddf933d6ebe4ac

  • SHA512

    712a4ff9c0d401c757c162cf91094fc5e977e3183cce364415823fe78f44e83d0e128730f25d2fcfae3319148118c0512d4fbc5b6fd608a3677b957209132ebd

  • SSDEEP

    24576:SbgHrheVS3QUa4EbvAH8MeRaW8OF+91iYv4Y22cMUrRnZlRvdseSb1WS8b7zF61A:SOeQQr4EbvdQOQiYvku23rsZWS8b7ZX

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

allay.f3322.net:5050

Mutex

fgidvwdtbfcdtau

Attributes
  • delay

    1

  • install

    true

  • install_file

    WriteFile.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-28_15580dae4a38e0ee4581c1cb3b1d98eb_asyncrat_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-28_15580dae4a38e0ee4581c1cb3b1d98eb_asyncrat_icedid.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Client.exe
      "C:\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WriteFile" /tr '"C:\Users\Admin\AppData\Roaming\WriteFile.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "WriteFile" /tr '"C:\Users\Admin\AppData\Roaming\WriteFile.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1456
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7782.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:1336
        • C:\Users\Admin\AppData\Roaming\WriteFile.exe
          "C:\Users\Admin\AppData\Roaming\WriteFile.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1744
      2⤵
      • Program crash
      PID:3432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4344 -ip 4344
    1⤵
      PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Client.exe

      Filesize

      74KB

      MD5

      91b01e99b841549fb21482b956ac78cf

      SHA1

      82d240f2c2ae343f4d7c6fd37af7e41374935a5f

      SHA256

      6036f85e4763107b83190d95294b87202d451a2548f4b90cc862ea81f269c0db

      SHA512

      10acfdd4d14ca93b2b05932b16b4940afff020aa18f6ded0799749e0f793f8fc94874cf5e55fb2acf041e233cc0bedcc272cadfbb5d4516f9abdcd6ef18d9b0a

    • C:\Users\Admin\AppData\Local\Temp\tmp7782.tmp.bat

      Filesize

      153B

      MD5

      49ca141bbe17a503b7ed5da2f7e9898c

      SHA1

      2e11c6b1c06ae2858e32591922723c997b8557f1

      SHA256

      576e281ba36a661f7c66d09594729de680f3de83705047cbe1fe22a0b4b9c213

      SHA512

      28bed7fb5a191c01fc7c8c67b7d04acb8b95fd279dd79385f0d4cfd33d30033062c8d73127bcae1f44752cd846d3854fca6787184acbafc3910453c64f9dabc5

    • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

      Filesize

      8B

      MD5

      cf759e4c5f14fe3eec41b87ed756cea8

      SHA1

      c27c796bb3c2fac929359563676f4ba1ffada1f5

      SHA256

      c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

      SHA512

      c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

    • memory/4344-6-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-4-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-21-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-45-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-18-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-36-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-34-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-42-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-32-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-30-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-28-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-16-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-24-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-23-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-38-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-2-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-26-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-14-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-12-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-10-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-8-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-0-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-40-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4344-43-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

      Filesize

      60KB

    • memory/4344-1-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/4864-57-0x0000000000D70000-0x0000000000D88000-memory.dmp

      Filesize

      96KB

    • memory/4864-64-0x00007FFF98440000-0x00007FFF98F01000-memory.dmp

      Filesize

      10.8MB

    • memory/4864-59-0x00007FFF98440000-0x00007FFF98F01000-memory.dmp

      Filesize

      10.8MB

    • memory/4864-56-0x00007FFF98443000-0x00007FFF98445000-memory.dmp

      Filesize

      8KB