Analysis
-
max time kernel
204s -
max time network
206s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
08-08-2024 07:49
General
-
Target
1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe
-
Size
48KB
-
MD5
a4c35dcd0013a04666a9d58095ff4060
-
SHA1
8943579c1d6db5bb74322efec322a4a6a6c00723
-
SHA256
1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202
-
SHA512
7e63464b4bd2cbec56e7635c77a7bf15d2d8983b25e63e81b1f08ca202ca24252bf4de60b96e578885c284c64e5b85b4b373cb07fd4469fb8acf49c7d216c178
-
SSDEEP
768:zuifNTdFHLBWUZzGrmo2qrA75dsmegjs6Za3PIO6oIxlY0bsSVola1uFhHToCHbg:zuifNTdB+2Xegjs6MwODmTbscOnHTPa7
Malware Config
Extracted
asyncrat
0.5.7B
July 26
donzola.duckdns.org:2000
AsyncMutex_iuykt5yr5ur58n8tnur8herjncr8tk
-
delay
3
-
install
false
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe"C:\Users\Admin\AppData\Local\Temp\1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SelectBlock.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\InvokeRestart.dot"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
263B
MD595c9d48759c0f88f3c7932dac0f58e69
SHA161652a162d5c4ef9195d73dd7c5e9e83990265a8
SHA25604405a2f8d93559866f4f9c641e0549fd6da4546556d45637b70ae2b08f700fe
SHA512a0ce30a134a8c573b6d32dcf08d693d37967582c4ff2c244f4523198c18d8bdd3b0fa5baa2ebc6c2119d732205f75c008dcdc8e1fc5aeb7fca915f3e3e8cca70
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
72KB
-
Filesize
6.9MB