Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 19:46

General

  • Target

    284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe

  • Size

    266KB

  • MD5

    4e4023be3e23245fd40b90f1222e9e9e

  • SHA1

    43c1fe1ffb8e72019839c1dd65925739c7521b1a

  • SHA256

    284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce

  • SHA512

    4a0701468cd22dd3b090868d0f0350f238dcc0f1e775e70093ae469362603dcb41ab3316c8353977b821672cb33452310548cff15d0fd4344c010906b1933ca4

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/D:WFzDqa86hV6uRRqX1evPlwAr

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
    "C:\Users\Admin\AppData\Local\Temp\284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
      "C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3908
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4204
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 180
        3⤵
        • Delays execution with timeout.exe
        PID:4788
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1272

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat

      Filesize

      213B

      MD5

      0955cb4b691d44b37f8b6fad48a33b8e

      SHA1

      9dae759ae014cc124ab6eed7c8035788c124ae4a

      SHA256

      9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71

      SHA512

      08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

    • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

      Filesize

      266KB

      MD5

      698de54a693fc7adf95df039c2725928

      SHA1

      7dc085a7fcb34a82618ee2a649479f25d5498496

      SHA256

      6aad5c1c55e9d805f509187f4ed9910ff9026a5e9edfe2e3915fa5fe57c78741

      SHA512

      0fbf16e3ebc30df77515f81c8e8dfbb3cef61f2a3a10a34543f931574d3d93494c326a4023a56110fe15e4bac55798ea289900f8297ac50b86c1ff9627c30027

    • memory/3256-6-0x0000000005180000-0x000000000518A000-memory.dmp

      Filesize

      40KB

    • memory/3256-3-0x0000000005190000-0x0000000005222000-memory.dmp

      Filesize

      584KB

    • memory/3256-4-0x0000000005230000-0x000000000523A000-memory.dmp

      Filesize

      40KB

    • memory/3256-5-0x0000000074CB0000-0x0000000075460000-memory.dmp

      Filesize

      7.7MB

    • memory/3256-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

      Filesize

      4KB

    • memory/3256-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

      Filesize

      5.6MB

    • memory/3256-24-0x0000000074CB0000-0x0000000075460000-memory.dmp

      Filesize

      7.7MB

    • memory/3256-1-0x0000000000750000-0x0000000000796000-memory.dmp

      Filesize

      280KB

    • memory/3908-25-0x0000000074CB0000-0x0000000075460000-memory.dmp

      Filesize

      7.7MB

    • memory/3908-27-0x0000000074CB0000-0x0000000075460000-memory.dmp

      Filesize

      7.7MB

    • memory/3908-30-0x0000000074CB0000-0x0000000075460000-memory.dmp

      Filesize

      7.7MB

    • memory/4204-28-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB