Overview
overview
10Static
static
1NOTIFICACI...DA.exe
windows7-x64
10NOTIFICACI...DA.exe
windows10-2004-x64
10NOTIFICACI...32.dll
windows7-x64
1NOTIFICACI...32.dll
windows10-2004-x64
1NOTIFICACI...32.dll
windows7-x64
3NOTIFICACI...32.dll
windows10-2004-x64
3NOTIFICACI...ar.dll
windows7-x64
3NOTIFICACI...ar.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/01 CITACION DEMANDA.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/01 CITACION DEMANDA.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/madHcNet32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/madHcNet32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/mvrSettings32.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/mvrSettings32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/unrar.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/unrar.dll
Resource
win10v2004-20240709-en
General
-
Target
NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/01 CITACION DEMANDA.exe
-
Size
3.1MB
-
MD5
b841d408448f2a07f308ced1589e7673
-
SHA1
f5b5095c0ed69d42110df6d39810d12b1fa32a1e
-
SHA256
69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699
-
SHA512
a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93
-
SSDEEP
49152:pvFg5qg9BtIAHE3SM4ahx6LK2SamuZob+tCjNrv8:Jm5qGBHBLRKuZfkjNrv8
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
juanjuan20231.kozow.com:2107
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3172 set thread context of 4800 3172 01 CITACION DEMANDA.exe 85 PID 4800 set thread context of 1048 4800 cmd.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3172 01 CITACION DEMANDA.exe 3172 01 CITACION DEMANDA.exe 4800 cmd.exe 4800 cmd.exe 1048 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3172 01 CITACION DEMANDA.exe 4800 cmd.exe 4800 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1048 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1048 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4800 3172 01 CITACION DEMANDA.exe 85 PID 3172 wrote to memory of 4800 3172 01 CITACION DEMANDA.exe 85 PID 3172 wrote to memory of 4800 3172 01 CITACION DEMANDA.exe 85 PID 3172 wrote to memory of 4800 3172 01 CITACION DEMANDA.exe 85 PID 4800 wrote to memory of 1048 4800 cmd.exe 97 PID 4800 wrote to memory of 1048 4800 cmd.exe 97 PID 4800 wrote to memory of 1048 4800 cmd.exe 97 PID 4800 wrote to memory of 1048 4800 cmd.exe 97 PID 4800 wrote to memory of 1048 4800 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-\01 CITACION DEMANDA.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-\01 CITACION DEMANDA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
Network
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request192.142.123.92.in-addr.arpaIN PTRResponse192.142.123.92.in-addr.arpaIN PTRa92-123-142-192deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418564_10W6V5F7I280O8R44&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418564_10W6V5F7I280O8R44&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 563726
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C985DB35CBD34FBF82ED951532C7B304 Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:07 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418563_16RSKIH5RQZW91ZBH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418563_16RSKIH5RQZW91ZBH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 324887
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 909BE385243F4820BB566F6515B47135 Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:07 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301169_1B5BA0C4QNKYTONE8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301169_1B5BA0C4QNKYTONE8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 427192
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 35245E49DDB24B6FBBA5E054D492803D Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:07 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 544577
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2DCC88DA0C374FE1B9852904DD1A549E Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:07 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 646893
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8249B714E49B4B659C59CF0DD261527C Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:07 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301578_16RTS3GAZ3AT29YOT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301578_16RTS3GAZ3AT29YOT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 480018
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CEFC0029A8F24675A5574CC00CAB29F0 Ref B: LON04EDGE1010 Ref C: 2024-07-18T01:28:08Z
date: Thu, 18 Jul 2024 01:28:08 GMT
-
Remote address:8.8.8.8:53Request10.28.171.150.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestjuanjuan20231.kozow.comIN AResponsejuanjuan20231.kozow.comIN A45.77.72.186
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.8kB 15 12
-
150.171.28.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317301578_16RTS3GAZ3AT29YOT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2107.5kB 3.1MB 2262 2258
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418564_10W6V5F7I280O8R44&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418563_16RSKIH5RQZW91ZBH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301169_1B5BA0C4QNKYTONE8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301578_16RTS3GAZ3AT29YOT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200 -
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
156 B 3
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
240.143.123.92.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
205.47.74.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
192.142.123.92.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10
-
72 B 158 B 1 1
DNS Request
10.28.171.150.in-addr.arpa
-
69 B 85 B 1 1
DNS Request
juanjuan20231.kozow.com
DNS Response
45.77.72.186
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
774KB
MD52f23a7c3cf7fb4328baa1edf3a4e6371
SHA1173a3953f8af5541af29ca942539ace59521aa31
SHA256cd69c8995efdf4661041264e824116513d8d2d602266caf7e4a45f3db08776c0
SHA512983e1f3f33edd2538b344365757a4ba807a4d55ef02602fc79f627ca453f3095a7b8422903b8669f574fe2d82166024dea213c00898d32487d5fbcb7be13a7a5