Malware Analysis Report

2025-04-13 12:36

Sample ID 240802-wzc85azbqe
Target TON DDOS.exe
SHA256 f323b5b0eae72fea64467cc0cc66af93aedac7a524246b7014ef63b50e325ff7
Tags
rat default asyncrat discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f323b5b0eae72fea64467cc0cc66af93aedac7a524246b7014ef63b50e325ff7

Threat Level: Known bad

The file TON DDOS.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat discovery

Asyncrat family

AsyncRat

Async RAT payload

Async RAT payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-02 18:21

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-02 18:21

Reported

2024-08-02 18:21

Platform

win7-20240729-en

Max time kernel

17s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A 4.tcp.ngrok.io N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\launcher1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2864 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2864 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2864 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2880 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2880 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2880 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2880 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 2880 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe

"C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "launcher1" /tr '"C:\Users\Admin\AppData\Roaming\launcher1.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp87A7.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "launcher1" /tr '"C:\Users\Admin\AppData\Roaming\launcher1.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\launcher1.exe

"C:\Users\Admin\AppData\Roaming\launcher1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 4.tcp.ngrok.io udp
US 3.136.65.236:19672 4.tcp.ngrok.io tcp
US 3.136.65.236:19672 4.tcp.ngrok.io tcp

Files

memory/2240-0-0x000000007438E000-0x000000007438F000-memory.dmp

memory/2240-1-0x00000000010D0000-0x00000000010E8000-memory.dmp

memory/2240-2-0x0000000074380000-0x0000000074A6E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp87A7.tmp.bat

MD5 a560e3921e367e4057d6491f78d92a62
SHA1 5552a57f118891a25f5573adefe435fcc3df208f
SHA256 de239cf494f6e6b8b5e09f6a6011fb7e24cb0451770af969cb05c8c2b953ee23
SHA512 673697c82297d092eccf825ccca3fdd4e55aa689a37c4972cd6ac244152a40c58e4f2c976ea26b59294157cbfdeb9e97609b63b87cdd974373c7c7a017cbf1e4

memory/2240-12-0x0000000074380000-0x0000000074A6E000-memory.dmp

\Users\Admin\AppData\Roaming\launcher1.exe

MD5 06eaec3a5cb7252e97abd37ddf54197f
SHA1 74e6a469391440d9ac7d1adc9441da069d9cfc44
SHA256 f323b5b0eae72fea64467cc0cc66af93aedac7a524246b7014ef63b50e325ff7
SHA512 514522a7284dcec3a7f8c57370c05086ad0852f63937b39ef0800d8180a978539afb4047e8c064ec4455030ddbe2b8fc1d95b053e2b729e8569425900783a66f

memory/2736-16-0x0000000000990000-0x00000000009A8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-02 18:21

Reported

2024-08-02 18:21

Platform

win10v2004-20240802-en

Max time kernel

21s

Max time network

27s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A 4.tcp.ngrok.io N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\launcher1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\launcher1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe C:\Windows\SysWOW64\cmd.exe
PID 3396 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3396 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3396 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2076 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2076 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2076 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3396 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 3396 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe
PID 3396 wrote to memory of 2948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\launcher1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe

"C:\Users\Admin\AppData\Local\Temp\TON DDOS.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "launcher1" /tr '"C:\Users\Admin\AppData\Roaming\launcher1.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC8C.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "launcher1" /tr '"C:\Users\Admin\AppData\Roaming\launcher1.exe"'

C:\Users\Admin\AppData\Roaming\launcher1.exe

"C:\Users\Admin\AppData\Roaming\launcher1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 4.tcp.ngrok.io udp
US 3.136.65.236:19672 4.tcp.ngrok.io tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 3.136.65.236:19672 4.tcp.ngrok.io tcp

Files

memory/1524-0-0x000000007520E000-0x000000007520F000-memory.dmp

memory/1524-1-0x00000000004C0000-0x00000000004D8000-memory.dmp

memory/1524-2-0x0000000075200000-0x00000000759B0000-memory.dmp

memory/1524-3-0x0000000004E80000-0x0000000004EE6000-memory.dmp

memory/1524-4-0x0000000005310000-0x00000000053AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpAC8C.tmp.bat

MD5 165496307a44059cd958b3bc44d9c8fa
SHA1 1d48b018a02f924221473b3f4a2f3cc4d6916ea3
SHA256 082b58b5cd1ab9f446bb80515da2ef2df2777fa5c85cf410ba5d88a82cf65834
SHA512 ba2326cec5f79b0765d229ce15f2f9ce232fceae73d78e9cad64c0b526712076799d37f65b1c305001b8010c93ca510006fe49d9cec74f9746060b2a3693dc03

memory/1524-10-0x0000000075200000-0x00000000759B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\launcher1.exe

MD5 06eaec3a5cb7252e97abd37ddf54197f
SHA1 74e6a469391440d9ac7d1adc9441da069d9cfc44
SHA256 f323b5b0eae72fea64467cc0cc66af93aedac7a524246b7014ef63b50e325ff7
SHA512 514522a7284dcec3a7f8c57370c05086ad0852f63937b39ef0800d8180a978539afb4047e8c064ec4455030ddbe2b8fc1d95b053e2b729e8569425900783a66f

memory/2948-14-0x0000000074E20000-0x00000000755D0000-memory.dmp