Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
19/07/2024, 22:33
General
- Target 33.exe
- Size 682KB
- Sample240719-2gl17stcpl
- SHA256 0b5e7cdc5d5290f43799f61ef80cc36d163b3eed96480f77fd805d2cc34d44c8
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 34 IoCs
- .NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33.exe"C:\Users\Admin\AppData\Local\Temp\33.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp240D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svhosts.exe"C:\Users\Admin\AppData\Roaming\svhosts.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp240D.tmp.bat
svhosts.exe
memory/1448-2728-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/1448-2967-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/1448-2968-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/1448-5443-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/1448-5442-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/1448-5441-0x0000000074A70000-0x0000000075221000-memory.dmp
memory/2968-58-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-34-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-5-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/2968-27-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-62-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-70-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-100-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/2968-68-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-66-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-64-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-60-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-56-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-54-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-52-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-50-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-46-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-44-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-42-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-3-0x0000000004E60000-0x0000000005406000-memory.dmp
memory/2968-48-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-40-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-38-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-36-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-4-0x0000000005410000-0x00000000054DC000-memory.dmp
memory/2968-32-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-31-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/2968-29-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-25-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-23-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-21-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-19-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-17-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-15-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-13-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-11-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-9-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-7-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-2-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/2968-1-0x0000000004D50000-0x0000000004E1E000-memory.dmp
memory/2968-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
memory/2968-6-0x0000000005410000-0x00000000054D7000-memory.dmp
memory/2968-2716-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/2968-2717-0x0000000005D40000-0x0000000005DDC000-memory.dmp
memory/2968-2718-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/2968-2723-0x0000000074A80000-0x0000000075231000-memory.dmp