Malware Analysis Report

2024-10-23 19:27

Sample ID 240629-nkrh7swgqh
Target normal.exe
SHA256 659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc

Threat Level: Known bad

The file normal.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

AsyncRat

Async RAT payload

Async RAT payload

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Scheduled Task/Job: Scheduled Task

Modifies registry class

Delays execution with timeout.exe

Checks SCSI registry key(s)

Gathers network information

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-29 11:27

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 11:27

Reported

2024-06-29 11:30

Platform

win10-20240611-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\update.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\4183903823\2290032291.pri C:\Windows\system32\taskmgr.exe N/A
File created C:\Windows\rescache\_merged\1601268389\715946058.pri C:\Windows\system32\taskmgr.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\update.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2584 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4720 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4720 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4720 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2784 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2784 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2784 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4720 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 4720 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 4720 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 5020 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 5020 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\normal.exe

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE772.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'

C:\Users\Admin\AppData\Roaming\update.exe

"C:\Users\Admin\AppData\Roaming\update.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\ipconfig.exe

ipconfig

Network

Country Destination Domain Proto
US 20.189.173.11:443 tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp

Files

memory/2584-0-0x00007FFDFC070000-0x00007FFDFC24B000-memory.dmp

memory/2584-1-0x0000000000580000-0x0000000000592000-memory.dmp

memory/2584-2-0x0000000004EF0000-0x0000000004F8C000-memory.dmp

memory/2584-7-0x00007FFDFC070000-0x00007FFDFC24B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE772.tmp.bat

MD5 5e2719daf60432c9227c2112e48b0b90
SHA1 de96bf8cdda01a98d94419ae38ca9d6363ee918e
SHA256 19ab6ab1d7f4bcec1ef25bb05eb219a16e5ee6cf97507cd3152cf4869151a344
SHA512 e22f37479e85d22224c206d400784b726c7ae4ac4d6a4d90685c9d272b0218c68442804521e38b261a266f40005af8de80d7d00e6249bd4a961f498a24556280

C:\Users\Admin\AppData\Roaming\update.exe

MD5 24de871a8fa5bc8a878ae2b76ccf7081
SHA1 c31b38ed40a3e89d2c156851740cf50c6b42441e
SHA256 659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
SHA512 9bfad714aa138a4de3c568540ae07ea65c57f4230748d74561a18dc125de1e47bb1fa27c4fb30b1d52d554e240c48435e60d2c46989453fffa8fe1930195e859

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-29 11:27

Reported

2024-06-29 11:30

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\normal.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\update.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4816 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 824 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 824 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 824 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4460 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4460 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4460 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 824 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 824 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 824 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\normal.exe

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5B7E.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'

C:\Users\Admin\AppData\Roaming\update.exe

"C:\Users\Admin\AppData\Roaming\update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp

Files

memory/4816-0-0x000000007486E000-0x000000007486F000-memory.dmp

memory/4816-1-0x0000000000020000-0x0000000000032000-memory.dmp

memory/4816-2-0x0000000074860000-0x0000000075010000-memory.dmp

memory/4816-3-0x00000000048E0000-0x000000000497C000-memory.dmp

memory/4816-8-0x0000000074860000-0x0000000075010000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5B7E.tmp.bat

MD5 a9e561303ad3d1403cdc10528815ae71
SHA1 aa99c5af5766e1ebe8781c19f6a5b2a458569a6b
SHA256 3b0fe9486fe9ba1f6df80fd06591df664393353ef190e5fd2cbb4133486e7afe
SHA512 349d3ba39d71f11d5f7d2c97762457776a017fd76f14feabbfedbee5c928b041eb45cf0f2f56cecadc44c784d3608aee9a0095cce5f99353eec5f3b56871e708

C:\Users\Admin\AppData\Roaming\update.exe

MD5 24de871a8fa5bc8a878ae2b76ccf7081
SHA1 c31b38ed40a3e89d2c156851740cf50c6b42441e
SHA256 659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
SHA512 9bfad714aa138a4de3c568540ae07ea65c57f4230748d74561a18dc125de1e47bb1fa27c4fb30b1d52d554e240c48435e60d2c46989453fffa8fe1930195e859

memory/2564-13-0x0000000074860000-0x0000000075010000-memory.dmp

memory/2564-14-0x0000000074860000-0x0000000075010000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-29 11:27

Reported

2024-06-29 11:30

Platform

win11-20240508-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\update.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\normal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 3252 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 3252 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 3252 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 3252 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 3252 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\normal.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4152 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4152 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3992 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3992 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3992 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3992 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 3992 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe
PID 3992 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\normal.exe

"C:\Users\Admin\AppData\Local\Temp\normal.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8DE8.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\update.exe

"C:\Users\Admin\AppData\Roaming\update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 pastebin.com udp

Files

memory/3252-0-0x00000000752FE000-0x00000000752FF000-memory.dmp

memory/3252-1-0x0000000000E60000-0x0000000000E72000-memory.dmp

memory/3252-2-0x00000000752F0000-0x0000000075AA1000-memory.dmp

memory/3252-3-0x0000000005970000-0x0000000005A0C000-memory.dmp

memory/3252-8-0x00000000752F0000-0x0000000075AA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8DE8.tmp.bat

MD5 581f776a593a275596ab215cb14afc99
SHA1 e492f46f74045bcd09a5c8f980e6bf5ed465fc05
SHA256 8496f90e1f012ecca199015f867cfca84edae9c21e1d6a40218402e5ba28e6f9
SHA512 ecd1499b73e3dd0b670fc90c388d9eb9d9729fc6f6710ca94bf4c1042b169df11c2fe33432fdfd4cdb2597ad982f85350ef7516edd272dd2bbb4fa22f305cbab

C:\Users\Admin\AppData\Roaming\update.exe

MD5 24de871a8fa5bc8a878ae2b76ccf7081
SHA1 c31b38ed40a3e89d2c156851740cf50c6b42441e
SHA256 659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
SHA512 9bfad714aa138a4de3c568540ae07ea65c57f4230748d74561a18dc125de1e47bb1fa27c4fb30b1d52d554e240c48435e60d2c46989453fffa8fe1930195e859

memory/3256-13-0x0000000075240000-0x00000000759F1000-memory.dmp

memory/3256-14-0x0000000075240000-0x00000000759F1000-memory.dmp