Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
19/07/2024, 22:33
General
- Target 33.exe
- Size 682KB
- Sample240719-2gl17stcpl
- SHA256 0b5e7cdc5d5290f43799f61ef80cc36d163b3eed96480f77fd805d2cc34d44c8
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 34 IoCs
- .NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33.exe"C:\Users\Admin\AppData\Local\Temp\33.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp728B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svhosts.exe"C:\Users\Admin\AppData\Roaming\svhosts.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp728B.tmp.bat
svhosts.exe
memory/2892-2728-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-2729-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-3138-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-5444-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-5443-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-5442-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/2892-2982-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-48-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-34-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-11-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-9-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-18-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-65-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-71-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-69-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-67-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-62-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-63-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-60-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-59-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-56-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-54-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-52-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-50-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-4-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-46-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-44-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-42-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-40-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-36-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-5-0x0000000005320000-0x00000000053EC000-memory.dmp
memory/4240-32-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-31-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-28-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-26-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-24-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-22-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-20-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-17-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-38-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-15-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-13-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-7-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-3-0x0000000004D70000-0x0000000005314000-memory.dmp
memory/4240-2-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-1-0x0000000004C20000-0x0000000004CEE000-memory.dmp
memory/4240-0-0x000000007474E000-0x000000007474F000-memory.dmp
memory/4240-6-0x0000000005320000-0x00000000053E7000-memory.dmp
memory/4240-2716-0x00000000055D0000-0x0000000005636000-memory.dmp
memory/4240-2717-0x0000000005C80000-0x0000000005D1C000-memory.dmp
memory/4240-2718-0x0000000074740000-0x0000000074EF0000-memory.dmp
memory/4240-2723-0x0000000074740000-0x0000000074EF0000-memory.dmp