Analysis

  • max time kernel
    119s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15-07-2024 13:00

General

  • Target

    df122e354805f285fd22e12b164a4da0N.exe

  • Size

    266KB

  • MD5

    df122e354805f285fd22e12b164a4da0

  • SHA1

    ee3d63367b20698b0aff5c51abacf67c9cc6b2f8

  • SHA256

    8a3690702482665cca5b9dfe9ad57fb5809942007425cd1b1e0cd8edf977f225

  • SHA512

    a403ef15dc400097373755738a8ed2d9f3971b5babfebadf0dd6c4055a3b943f1b769f0f2e7c324c42606b3236d3d668f0facc6f894ba888940310f1305d9b87

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sr:WFzDqa86hV6uRRqX1evPlwAEr

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Contains code to disable Windows Defender 5 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df122e354805f285fd22e12b164a4da0N.exe
    "C:\Users\Admin\AppData\Local\Temp\df122e354805f285fd22e12b164a4da0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
      "C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2688
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""
      2⤵
        PID:3044
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1052

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat

        Filesize

        213B

        MD5

        0955cb4b691d44b37f8b6fad48a33b8e

        SHA1

        9dae759ae014cc124ab6eed7c8035788c124ae4a

        SHA256

        9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71

        SHA512

        08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

      • C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

        Filesize

        266KB

        MD5

        991bbcde78b1e356baccd0ab8f6a8996

        SHA1

        050a8672d666c1fb942c95efd95c06dbaf25aa86

        SHA256

        012caa3545c570ec9796315c025e95d2cfdf4c236fb12009ead88effce01f436

        SHA512

        e5b78ee6568998d78abf52551f80d4d7d55dd8a6199c2cc5a7c8e2fbaf9af1fb011641ab28272300aee6f7b6b3672381da65b8387f59e5210d80d67811a36723

      • memory/2304-24-0x0000000074770000-0x0000000074E5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2304-2-0x0000000000210000-0x000000000021A000-memory.dmp

        Filesize

        40KB

      • memory/2304-1-0x0000000000D00000-0x0000000000D46000-memory.dmp

        Filesize

        280KB

      • memory/2304-3-0x0000000074770000-0x0000000074E5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2304-0-0x000000007477E000-0x000000007477F000-memory.dmp

        Filesize

        4KB

      • memory/2688-27-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-31-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-25-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-36-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-34-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-35-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2688-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2688-29-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/2848-21-0x0000000000270000-0x00000000002B6000-memory.dmp

        Filesize

        280KB

      • memory/2848-37-0x0000000074770000-0x0000000074E5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2848-22-0x0000000074770000-0x0000000074E5E000-memory.dmp

        Filesize

        6.9MB