Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
13/07/2024, 12:34
General
- Target cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a.exe
- Size 607KB
- Sample240713-prwbea1bkr
- SHA256 cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
AsyncMutex_6SI8OkPnk
-
c2_url_file
http://update-checker-status.cc/OCB-Async.txt
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a.exe"C:\Users\Admin\AppData\Local\Temp\cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1868-6-0x0000000037800000-0x0000000037866000-memory.dmp
memory/1868-12-0x0000000074340000-0x0000000074AF1000-memory.dmp
memory/1868-2-0x0000000005600000-0x0000000005652000-memory.dmp
memory/1868-3-0x0000000074340000-0x0000000074AF1000-memory.dmp
memory/1868-4-0x0000000005670000-0x00000000056A0000-memory.dmp
memory/1868-5-0x0000000005760000-0x00000000057AC000-memory.dmp
memory/1868-1-0x0000000000B90000-0x0000000000C2E000-memory.dmp
memory/1868-8-0x00000000386A0000-0x0000000038C46000-memory.dmp
memory/1868-0-0x000000007434E000-0x000000007434F000-memory.dmp
memory/1868-7-0x0000000038050000-0x00000000380E2000-memory.dmp
memory/5092-10-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5092-13-0x0000000074340000-0x0000000074AF1000-memory.dmp
memory/5092-14-0x0000000074340000-0x0000000074AF1000-memory.dmp
memory/5092-15-0x0000000074340000-0x0000000074AF1000-memory.dmp
memory/5092-16-0x0000000074340000-0x0000000074AF1000-memory.dmp