Overview

overview

10

Static

static

10

0x00090000...52.exe

windows7-x64

10

0x00090000...52.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0x000900000001562c-52.exe

  • Size

    46KB

  • MD5

    10b549c788d008fc48cccac97d0d41f5

  • SHA1

    f0c723bb0c9123875a1a208e3ec46f4ec4108be0

  • SHA256

    589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9

  • SHA512

    bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

  • SSDEEP

    768:bqjrtbXgQQDykOicvHk3eHlWMPbPgF0q9+SohzEBYI6OCy2tYcFmVc6KD:bBDyXvZH0ub4FroSolY6O3KmVclD

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

dgorijan20785.hopto.org:6606

dgorijan20785.hopto.org:7707

dgorijan20785.hopto.org:8808
Mutex

v5tvc5rc5ex77777

Attributes
  • delay

    5

  • install

    true

  • install_file

    audiodvs.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000900000001562c-52.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000900000001562c-52.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodvs.exe"'
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3748
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC340.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4560
      • C:\Users\Admin\AppData\Roaming\audiodvs.exe
        "C:\Users\Admin\AppData\Roaming\audiodvs.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpC340.tmp.bat
    Filesize

    152B

    MD5

    5f2da7de0c308f0dd143e521a4be4df2

    SHA1

    b2cc02e41cc503f83690191393358631268d3c68

    SHA256

    7153b02d39ea59d65246fbb7b0ce03a7d3ceb7343c8c366d3e4598390d37cfbf

    SHA512

    82b5f532e50dd807830a825811e8fbe7e115ac1d4f1c05673a87c0f0c36dcc7ef84baccf8b04379c3b7f00e4e83a159f33637263e202a326600b1d790a1345e8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\audiodvs.exe
    Filesize

    41.9MB

    MD5

    6d85170619d9a8c166fcee10b34ca1d7

    SHA1

    21cbf03bfc8764b10694f2252ff2254e19c2a27f

    SHA256

    6024ccb637908290f1023c696094f9647b54e394cda3c7fcfb50711aa61999ec

    SHA512

    603f0b4e07847c2a2c3b8e1a952e52338b3708f55213dadf7e8afb95116ef19488a2679f33d46546786b6c4421f29eb6a0afecae38a3d6dfc2e34dfe48b666f6

    Download Submit

  • memory/3044-0-0x00007FFFFC803000-0x00007FFFFC805000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3044-1-0x0000000000410000-0x0000000000422000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3044-2-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3044-8-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4860-12-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4860-13-0x00007FFFFC800000-0x00007FFFFD2C1000-memory.dmp

    Filesize

    10.8MB

    Download