Analysis
-
max time kernel
58s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2024 13:51
Errors
Reason
Machine shutdown
General
-
Target
svchost.exe
-
Size
47KB
-
MD5
e725a301ddf99bc5ac583daad86ff3f1
-
SHA1
10c5ee72d01b2d41260a9671b1a2d1f8e9cec982
-
SHA256
5d73c2e7efef4bb8ba29edda65f858d51b4a95c553801d92e349fccc525357ba
-
SHA512
13e620ffa45c3224ee8a5452be8d559f23bc23e28dcd1f9be3365556f59b9cb65e783ce45392b3c65c4dbe848be42546b0c4293c5761b8b189b574e488fa238d
-
SSDEEP
768:4uwpFTAY3IQWUe9jqmo2qLatl14oCM8LLIPI8qrqLwWJJ0bT0ef0/UEX66wt2PD1:4uwpFTA4/2ZSoCM898qrqLHJubTL8/CQ
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
31.173.170.243:7777
Mutex
t5Oy31wC0PXr
Attributes
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x00050000000229a0-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 464 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2684 timeout.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 1216 svchost.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4280 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1216 svchost.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 4280 taskmgr.exe Token: SeSystemProfilePrivilege 4280 taskmgr.exe Token: SeCreateGlobalPrivilege 4280 taskmgr.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe 4280 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4904 1216 svchost.exe 89 PID 1216 wrote to memory of 4904 1216 svchost.exe 89 PID 1216 wrote to memory of 4904 1216 svchost.exe 89 PID 1216 wrote to memory of 400 1216 svchost.exe 91 PID 1216 wrote to memory of 400 1216 svchost.exe 91 PID 1216 wrote to memory of 400 1216 svchost.exe 91 PID 4904 wrote to memory of 4672 4904 cmd.exe 93 PID 4904 wrote to memory of 4672 4904 cmd.exe 93 PID 4904 wrote to memory of 4672 4904 cmd.exe 93 PID 400 wrote to memory of 2684 400 cmd.exe 94 PID 400 wrote to memory of 2684 400 cmd.exe 94 PID 400 wrote to memory of 2684 400 cmd.exe 94 PID 400 wrote to memory of 464 400 cmd.exe 97 PID 400 wrote to memory of 464 400 cmd.exe 97 PID 400 wrote to memory of 464 400 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8ADB.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2684
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4280
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
614B
MD554920f388010333559bdff225040761d
SHA1040972bf1fc83014f10c45832322c094f883ce30
SHA2569ed5449a36700939987209c7a2974b9cc669b8b22c7c4e7936f35dda0a4dc359
SHA512e17aa5d1328b3bfd3754d15b3c2eded98653d90c7b326f941522e0b3bd6f557880246a6bc69047facb42eb97d2e0ed6c46148dfe95a98669fc4e1d07c21a285c
-
Filesize
151B
MD5088c28b9c6a34e3474eecc425ab962c9
SHA1b36950660a2301070ea088e3da1c53847af64ca7
SHA256b31b0e4fcd59e381eaea4850f140005efb1773ec0de0d011c1af7f13b6b60a14
SHA5129f83abae0d1654f631f82eade8a9d9ccd0105172db07d9e1a7a53f248800e5102f567219d8d405bc95c4739644b4205787686df54979b6c99ed0651d8e8f5d10
-
Filesize
47KB
MD5e725a301ddf99bc5ac583daad86ff3f1
SHA110c5ee72d01b2d41260a9671b1a2d1f8e9cec982
SHA2565d73c2e7efef4bb8ba29edda65f858d51b4a95c553801d92e349fccc525357ba
SHA51213e620ffa45c3224ee8a5452be8d559f23bc23e28dcd1f9be3365556f59b9cb65e783ce45392b3c65c4dbe848be42546b0c4293c5761b8b189b574e488fa238d