Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2024 02:24

General

  • Target

    e9837fc1d609e0084452590c09746a89af73ec6abf45a26ab58a4d48c9ebceac.exe

  • Size

    1007KB

  • MD5

    c1619d951b039ce9cb600815e8b14b26

  • SHA1

    4def66d57b972beb3065a29ed1fe88610943d383

  • SHA256

    e9837fc1d609e0084452590c09746a89af73ec6abf45a26ab58a4d48c9ebceac

  • SHA512

    c1f071ab1cbe2e12576227a69618f2a717d49c6fa632280b2d769c53c1c8d89bfe51bd524f5aed13fb67d84109e4aa99ec05d96a589284f275135f036bdb2edc

  • SSDEEP

    24576:heAy4u8ZernsYvWwUIGOh5rE1xrJK06WwkS9Ev95FZCyGWsfe:Iyern6VIVqxrJ5KyvVZCyGWsfe

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9837fc1d609e0084452590c09746a89af73ec6abf45a26ab58a4d48c9ebceac.exe
    "C:\Users\Admin\AppData\Local\Temp\e9837fc1d609e0084452590c09746a89af73ec6abf45a26ab58a4d48c9ebceac.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 5
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\SysWOW64\timeout.exe
        timeout 5
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:3764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 5
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\timeout.exe
        timeout 5
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3364

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    camanopetro.con-ip.com
    aspnet_compiler.exe
    Remote address:
    8.8.8.8:53
    Request
    camanopetro.con-ip.com
    IN A
    Response
    camanopetro.con-ip.com
    IN A
    64.188.9.173
  • flag-us
    DNS
    camanopetro.con-ip.com
    aspnet_compiler.exe
    Remote address:
    8.8.8.8:53
    Request
    camanopetro.con-ip.com
    IN A
    Response
    camanopetro.con-ip.com
    IN A
    64.188.9.173
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 64.188.9.173:1524
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1524
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1524
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1525
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1524
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1525
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1525
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1525
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 64.188.9.173:1526
    camanopetro.con-ip.com
    aspnet_compiler.exe
    260 B
    200 B
    5
    5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    camanopetro.con-ip.com
    dns
    aspnet_compiler.exe
    136 B
    168 B
    2
    2

    DNS Request

    camanopetro.con-ip.com

    DNS Request

    camanopetro.con-ip.com

    DNS Response

    64.188.9.173

    DNS Response

    64.188.9.173

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3364-1054-0x00000000013C0000-0x00000000013DB000-memory.dmp

    Filesize

    108KB

  • memory/3364-1055-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

    Filesize

    4KB

  • memory/3364-1056-0x00000000059D0000-0x00000000059EA000-memory.dmp

    Filesize

    104KB

  • memory/3364-1057-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/3364-1058-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/3364-1061-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/3364-1060-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

    Filesize

    4KB

  • memory/3364-1059-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-37-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-31-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-15-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-5-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-51-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-55-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-69-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-67-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-65-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-63-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-61-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-59-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-57-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-53-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-49-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-47-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-45-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-43-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-41-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-39-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-3-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-35-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-33-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-4-0x0000000005F30000-0x000000000601E000-memory.dmp

    Filesize

    952KB

  • memory/4888-29-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-27-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-25-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-23-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-21-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-19-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-17-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-13-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-11-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-9-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-7-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-6-0x0000000005F30000-0x0000000006017000-memory.dmp

    Filesize

    924KB

  • memory/4888-1042-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-1043-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-1044-0x0000000006170000-0x00000000061DE000-memory.dmp

    Filesize

    440KB

  • memory/4888-1045-0x00000000061E0000-0x000000000622C000-memory.dmp

    Filesize

    304KB

  • memory/4888-1046-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

    Filesize

    4KB

  • memory/4888-2-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-1-0x00000000001E0000-0x00000000002E2000-memory.dmp

    Filesize

    1.0MB

  • memory/4888-0-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

    Filesize

    4KB

  • memory/4888-1047-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4888-1048-0x0000000007460000-0x0000000007A04000-memory.dmp

    Filesize

    5.6MB

  • memory/4888-1049-0x0000000005700000-0x0000000005754000-memory.dmp

    Filesize

    336KB

  • memory/4888-1053-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.