Overview

overview

10

Static

static

10

c72c02aa10...66.exe

windows7-x64

10

c72c02aa10...66.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 05:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c72c02aa10e6609c29969f89b655aa99c7416aa87b391cf877fb1d31982bab66.exe

  • Size

    66KB

  • MD5

    433bf8f02605fcf30d63ee99f94be057

  • SHA1

    740c51573e09c20ea99054cde34eff26512c37a9

  • SHA256

    c72c02aa10e6609c29969f89b655aa99c7416aa87b391cf877fb1d31982bab66

  • SHA512

    75c5ba92e8a550838f2810f016ab22fb60e4e6005f141ade5d968e888e8c05ad9828b1c723cacb346991dddb20c5c49d7cf4b2e3451707f6b9293e1b58992d2d

  • SSDEEP

    1536:YKh54k58k/GWZOKuvUYF9ebF0ruhDbC0mvCMJurITGy/:YK/4k58kAKuvUYF9ebSruxbCjJuOh/

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

story-pl.gl.at.ply.gg:13978

Mutex

dsopfkpsdgkspohspog-0p

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c72c02aa10e6609c29969f89b655aa99c7416aa87b391cf877fb1d31982bab66.exe
    "C:\Users\Admin\AppData\Local\Temp\c72c02aa10e6609c29969f89b655aa99c7416aa87b391cf877fb1d31982bab66.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"' & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"'
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:532
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpACAB.tmp.bat""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:3648
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    Filesize

    66KB

    MD5

    433bf8f02605fcf30d63ee99f94be057

    SHA1

    740c51573e09c20ea99054cde34eff26512c37a9

    SHA256

    c72c02aa10e6609c29969f89b655aa99c7416aa87b391cf877fb1d31982bab66

    SHA512

    75c5ba92e8a550838f2810f016ab22fb60e4e6005f141ade5d968e888e8c05ad9828b1c723cacb346991dddb20c5c49d7cf4b2e3451707f6b9293e1b58992d2d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpACAB.tmp.bat
    Filesize

    154B

    MD5

    02eda5c36aa53054bc55004c168bda31

    SHA1

    c5335050bca6204ef77681457f00dad74edd98e1

    SHA256

    deee5ef7b14463f44d51093e990eb4b53913f5c228db98f946530138a64ec1ad

    SHA512

    4cbc0b5a80173778af63de8258a1797293f75d70f9800e8843a08c0436d5eeab6e73216afe680fae72980db0fa306024041e35ee8ecbddbd8039668b8a2a3dba

    Download Submit

  • memory/3772-3-0x0000000004CB0000-0x0000000004D16000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3772-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3772-4-0x0000000005100000-0x000000000519C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/3772-9-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3772-2-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3772-1-0x00000000002C0000-0x00000000002D6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/4692-14-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4692-15-0x0000000005F60000-0x0000000006504000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4692-16-0x0000000005AB0000-0x0000000005B42000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4692-17-0x0000000005A90000-0x0000000005A9A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4692-18-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

    Download