Analysis Overview
SHA256
15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca
Threat Level: Known bad
The file 2BB4A448B0132C70A9F3C03DB54A52F3.exe was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Async RAT payload
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Enumerates physical storage devices
Unsigned PE
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-14 06:26
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-14 06:26
Reported
2024-07-14 06:28
Platform
win7-20240704-en
Max time kernel
121s
Max time network
144s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\microssofte.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\microssofte.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe
"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Users\Admin\AppData\Roaming\microssofte.exe
"C:\Users\Admin\AppData\Roaming\microssofte.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | seznam.zapto.org | udp |
| US | 108.61.192.110:8808 | seznam.zapto.org | tcp |
Files
memory/2876-0-0x000000007430E000-0x000000007430F000-memory.dmp
memory/2876-1-0x0000000000230000-0x00000000002A8000-memory.dmp
memory/2876-2-0x0000000000490000-0x00000000004A2000-memory.dmp
memory/2876-3-0x0000000074300000-0x00000000749EE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp.bat
| MD5 | bb6c3bf2588770b5f957f1ec6c5ac1e1 |
| SHA1 | 6c8b2e62bf743f9d49e2f4cf989eea0793f62288 |
| SHA256 | 43013f34e03d801db6763a36bde0695852111a6c62d0db6a0ff55d939b0668e5 |
| SHA512 | 6bdeb6fe4424396664e10d6a9dc8bc15104409cee180c8d6a3ee76404fdb43633f3fa5d3ffc71d3d699531195fbd0807ddf9a790de7ec7da400002e18c1f9892 |
memory/2876-13-0x0000000074300000-0x00000000749EE000-memory.dmp
\Users\Admin\AppData\Roaming\microssofte.exe
| MD5 | 2bb4a448b0132c70a9f3c03db54a52f3 |
| SHA1 | 2338d8ae200271ccfcf5bb8d97c8c98c52deb43c |
| SHA256 | 15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca |
| SHA512 | 5352592d1dfb6771db491a18dda53c481aee0a072d2c511959f3e2cf9532ac176a6a2f9520b22a4d4675098e089a819f1b4da89d0ec615c9458bcff1ea4cbe29 |
memory/1236-17-0x0000000001040000-0x00000000010B8000-memory.dmp
memory/1236-18-0x0000000000450000-0x0000000000462000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabA3D0.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-14 06:26
Reported
2024-07-14 06:28
Platform
win10v2004-20240709-en
Max time kernel
94s
Max time network
138s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\microssofte.exe | N/A |
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\microssofte.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe
"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB40E.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Users\Admin\AppData\Roaming\microssofte.exe
"C:\Users\Admin\AppData\Roaming\microssofte.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | seznam.zapto.org | udp |
| US | 108.61.192.110:8808 | seznam.zapto.org | tcp |
| US | 8.8.8.8:53 | 110.192.61.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 108.61.192.110:8808 | seznam.zapto.org | tcp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
memory/3708-0-0x000000007522E000-0x000000007522F000-memory.dmp
memory/3708-1-0x0000000000800000-0x0000000000878000-memory.dmp
memory/3708-2-0x0000000005860000-0x0000000005E04000-memory.dmp
memory/3708-3-0x00000000052B0000-0x0000000005342000-memory.dmp
memory/3708-4-0x00000000051E0000-0x00000000051F2000-memory.dmp
memory/3708-5-0x0000000005350000-0x00000000053EC000-memory.dmp
memory/3708-6-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/3708-11-0x0000000075220000-0x00000000759D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpB40E.tmp.bat
| MD5 | 9293615ef62cba1398e4e78019bc48b8 |
| SHA1 | 88a388465e72efe8c6921b55ac0a1f399c7917e8 |
| SHA256 | d92b365e505b3d92d4a7286f5a15b848b184d1c1c671227cfece0d9b00661590 |
| SHA512 | 97e3268f7ce0f9f3a49b7ac48dda6974b10310d599fa237f9cae97874b6a96d1542be14670ef8c06d10162589d2a5d9f2fd8bb26a4d9b300031961a311e83899 |
C:\Users\Admin\AppData\Roaming\microssofte.exe
| MD5 | 2bb4a448b0132c70a9f3c03db54a52f3 |
| SHA1 | 2338d8ae200271ccfcf5bb8d97c8c98c52deb43c |
| SHA256 | 15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca |
| SHA512 | 5352592d1dfb6771db491a18dda53c481aee0a072d2c511959f3e2cf9532ac176a6a2f9520b22a4d4675098e089a819f1b4da89d0ec615c9458bcff1ea4cbe29 |
memory/432-16-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/432-17-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/432-18-0x00000000050C0000-0x0000000005126000-memory.dmp
memory/432-19-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/432-20-0x0000000006810000-0x0000000006886000-memory.dmp
memory/432-21-0x0000000000800000-0x0000000000828000-memory.dmp
memory/432-22-0x0000000000AF0000-0x0000000000B0E000-memory.dmp