Overview
overview
4Static
static
3Asuna Lite/Asuna.exe
windows7-x64
1Asuna Lite/Asuna.exe
windows10-1703-x64
1Asuna Lite/Asuna.exe
windows7-x64
4Asuna Lite/Asuna.exe
windows10-1703-x64
1Asuna Lite...ss.dll
windows7-x64
1Asuna Lite...ss.dll
windows10-1703-x64
1Asuna Lite...rp.dll
windows7-x64
1Asuna Lite...rp.dll
windows10-1703-x64
1Asuna Lite...PI.dll
windows7-x64
1Asuna Lite...PI.dll
windows10-1703-x64
1Analysis
-
max time kernel
55s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
Asuna Lite/Asuna.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Asuna Lite/Asuna.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Asuna Lite/Asuna.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Asuna Lite/Asuna.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Asuna Lite/SharpCompress.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Asuna Lite/SharpCompress.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Asuna Lite/ZstdSharp.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Asuna Lite/ZstdSharp.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Asuna Lite/bin/API.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Asuna Lite/bin/API.dll
Resource
win10-20240404-en
General
-
Target
Asuna Lite/Asuna.exe
-
Size
363KB
-
MD5
14eded1661b6adcfa19d9cd43b7a8148
-
SHA1
ee970fac39ed665195fc89fba0114c2dfb663c11
-
SHA256
6e9c819d4327b2319a9a336acc4f5b7c53e0b284ea66d28534a485a8d038dc94
-
SHA512
8c6d356e9ecacc7c5b9d2e79b80a5924f0cd790132734af52f2d4a1da3dffaac1a924c4b19fb7b1bfe7618828b4f24f912431c9c74baf15281daf44271febb74
-
SSDEEP
6144:xAi4pxpRkyHRZa0Gl278IVNcIcW+EbIo98QG9SZyMMyzmBlpkvOD:x4RlGI78IVlbIoSV9SZynnloO
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 340 mspaint.exe 340 mspaint.exe 340 mspaint.exe 340 mspaint.exe 3028 mspaint.exe 3028 mspaint.exe 3028 mspaint.exe 3028 mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Asuna Lite\Asuna.exe"C:\Users\Admin\AppData\Local\Temp\Asuna Lite\Asuna.exe"1⤵PID:1424
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2668
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\UninstallResume.wmf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:340
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\UnblockReset.emf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3028