Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe
Resource
win10v2004-20240611-en
General
-
Target
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe
-
Size
866KB
-
MD5
17d02350b80c3c03c0be2b1acab650d1
-
SHA1
775181f6686d21806ba7e6fe4ae1ecdc82d0157f
-
SHA256
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4
-
SHA512
e61b19867eb0aff9d43ab7f13ac73217d0bd244e8b908eb902940315d77c3df67fbde40f7d80d602d8f491065fdb98791deb5f3fd4c122ef010f09616d1aaade
-
SSDEEP
3072:dBUyU7/NUauKvxUjUYqDbf5PBb6Tx3zU5IYUeyUwgUn1UdjgUtGU4rZ/ME+h0UIx:CQdx8nHZtwjWK3FFQgzv1x5
Malware Config
Extracted
asyncrat
0.5.7B
Default
hgjvhnfgg.duckdns.org:8057
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe\"" de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-4-0x0000000005340000-0x0000000005368000-memory.dmp INDICATOR_SUSPICIOUS_DisableWinDefender -
Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-4-0x0000000005340000-0x0000000005368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-4-0x0000000005340000-0x0000000005368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Detects executables potentially checking for WinJail sandbox window 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-4-0x0000000005340000-0x0000000005368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Anti_WinJail behavioral2/memory/4192-4-0x0000000005340000-0x0000000005368000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste -
Detects file containing reversed ASEP Autorun registry keys 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2984-7-0x0000000000400000-0x0000000000412000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Drops startup file 2 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe" de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe" de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exepid process 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription pid process target process PID 4192 set thread context of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1484 4192 WerFault.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4388 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exepid process 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exedescription pid process Token: SeDebugPrivilege 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.execmd.exedescription pid process target process PID 4192 wrote to memory of 2068 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe cmd.exe PID 4192 wrote to memory of 2068 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe cmd.exe PID 4192 wrote to memory of 2068 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe cmd.exe PID 2068 wrote to memory of 4388 2068 cmd.exe timeout.exe PID 2068 wrote to memory of 4388 2068 cmd.exe timeout.exe PID 2068 wrote to memory of 4388 2068 cmd.exe timeout.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe PID 4192 wrote to memory of 2984 4192 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe"C:\Users\Admin\AppData\Local\Temp\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe"C:\Users\Admin\AppData\Local\Temp\de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe"2⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 12522⤵
- Program crash
PID:1484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 41921⤵PID:4464