Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240611-en
General
-
Target
file.exe
-
Size
866KB
-
MD5
17d02350b80c3c03c0be2b1acab650d1
-
SHA1
775181f6686d21806ba7e6fe4ae1ecdc82d0157f
-
SHA256
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4
-
SHA512
e61b19867eb0aff9d43ab7f13ac73217d0bd244e8b908eb902940315d77c3df67fbde40f7d80d602d8f491065fdb98791deb5f3fd4c122ef010f09616d1aaade
-
SSDEEP
3072:dBUyU7/NUauKvxUjUYqDbf5PBb6Tx3zU5IYUeyUwgUn1UdjgUtGU4rZ/ME+h0UIx:CQdx8nHZtwjWK3FFQgzv1x5
Malware Config
Extracted
asyncrat
0.5.7B
Default
hgjvhnfgg.duckdns.org:8057
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe\"" file.exe -
Drops startup file 2 IoCs
Processes:
file.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe file.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe file.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\file.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
file.exepid process 3016 file.exe 3016 file.exe 3016 file.exe 3016 file.exe 3016 file.exe 3016 file.exe 3016 file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 3016 set thread context of 2528 3016 file.exe file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2608 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
file.exepid process 3016 file.exe 3016 file.exe 3016 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 3016 file.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
file.execmd.exedescription pid process target process PID 3016 wrote to memory of 3012 3016 file.exe cmd.exe PID 3016 wrote to memory of 3012 3016 file.exe cmd.exe PID 3016 wrote to memory of 3012 3016 file.exe cmd.exe PID 3016 wrote to memory of 3012 3016 file.exe cmd.exe PID 3012 wrote to memory of 2608 3012 cmd.exe timeout.exe PID 3012 wrote to memory of 2608 3012 cmd.exe timeout.exe PID 3012 wrote to memory of 2608 3012 cmd.exe timeout.exe PID 3012 wrote to memory of 2608 3012 cmd.exe timeout.exe PID 3016 wrote to memory of 2532 3016 file.exe file.exe PID 3016 wrote to memory of 2532 3016 file.exe file.exe PID 3016 wrote to memory of 2532 3016 file.exe file.exe PID 3016 wrote to memory of 2532 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe PID 3016 wrote to memory of 2528 3016 file.exe file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵PID:2528