Overview

overview

10

Static

static

10

Shellbag anylizer.exe

windows11-21h2-x64

10

Resubmissions

08-08-2024 08:56

240808-kv41havgjh 10

08-08-2024 08:55

240808-kvncravgjb 10

08-08-2024 08:48

240808-kqyypavfpg 10

Analysis

  • max time kernel
    124s
  • max time network
    122s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-08-2024 08:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shellbag anylizer.exe

  • Size

    247KB

  • MD5

    851269fc86de5d91e5f2db1b2b34cb6e

  • SHA1

    6103dab45c98bddef65b6eed235a60159d458526

  • SHA256

    0b7987bd9f7cbee60c4c809f22ecda6f314a0366f0704ed474626ac5f7af3521

  • SHA512

    c01c7d2ec52d55ece6f88eeb9c5ecf260ef9b59fd3f08ad42e4ed582b24bd482fcfd334375177b032564f567af6d195f7627249abe1e428f52f6c2806783acfc

  • SSDEEP

    6144:/bwmPMVWrVbVPwF9kfK8rpClz0KBb6o589GHWHWujiSPbp:/bw8n5gBuj/PV

Score
10/10
asyncratdefaultdiscoverypersistenceprivilege_escalationrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

zedtklncvg

Attributes
  • delay

    1

  • install

    true

  • install_file

    update.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/f2T8NYnM

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe
    "C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2564
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC0A0.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3192
      • C:\Users\Admin\AppData\Roaming\update.exe
        "C:\Users\Admin\AppData\Roaming\update.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2208
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
    1⤵
    • Modifies system executable filetype association
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4836
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1148
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1064
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:2800
      • C:\Windows\System32\oobe\UserOOBEBroker.exe
        C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
        1⤵
        • Drops file in Windows directory
        PID:1028
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
        1⤵
        • System Location Discovery: System Language Discovery
        PID:2220
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2580
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4576
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4648
      • C:\Users\Admin\Desktop\Shellbag anylizer.exe
        "C:\Users\Admin\Desktop\Shellbag anylizer.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1640
      • C:\Users\Admin\Desktop\Shellbag anylizer.exe
        "C:\Users\Admin\Desktop\Shellbag anylizer.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3732
      • C:\Users\Admin\Desktop\Shellbag anylizer.exe
        "C:\Users\Admin\Desktop\Shellbag anylizer.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4880

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Shellbag anylizer.exe.log
        Filesize

        1KB

        MD5

        b4e91d2e5f40d5e2586a86cf3bb4df24

        SHA1

        31920b3a41aa4400d4a0230a7622848789b38672

        SHA256

        5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

        SHA512

        968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
        Filesize

        10KB

        MD5

        c3e08121cabb9380e3d50cadde97d53a

        SHA1

        0e666954e83e97e3883e52092fe2be88a520e8f8

        SHA256

        76e1d3ab7320c4b863adb091b5b77205d81e13eafb539a18ebe3d8ea46b29433

        SHA512

        9a6ef7710781d2f3a1f873129b21990548c1b275720080d87fe4051b464b0aef4ad8625656c388a65163563c6fb2086c29c01ba5f518c5b9679e7227fcc7941f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpC0A0.tmp.bat
        Filesize

        150B

        MD5

        192400e285af778c5948a96f977215fa

        SHA1

        e47e2fa56f793a0eb3a78d54de4ac439fafe2cb8

        SHA256

        ba8ffc2f20a33ff8f26fcbd5643fa04863847566cc29f82701ff36f5bc363c95

        SHA512

        59d8077e10fc9070816586bf463ed0ff85053cfcf514cf2fb0ca0fa33b3ceb7f1067d5e7da7401e97fc236645378f2f263fe09a1ba65797c9b2464f9576834ce

        Download Submit

      • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
        Filesize

        8B

        MD5

        cf759e4c5f14fe3eec41b87ed756cea8

        SHA1

        c27c796bb3c2fac929359563676f4ba1ffada1f5

        SHA256

        c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

        SHA512

        c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\update.exe
        Filesize

        247KB

        MD5

        851269fc86de5d91e5f2db1b2b34cb6e

        SHA1

        6103dab45c98bddef65b6eed235a60159d458526

        SHA256

        0b7987bd9f7cbee60c4c809f22ecda6f314a0366f0704ed474626ac5f7af3521

        SHA512

        c01c7d2ec52d55ece6f88eeb9c5ecf260ef9b59fd3f08ad42e4ed582b24bd482fcfd334375177b032564f567af6d195f7627249abe1e428f52f6c2806783acfc

        Download Submit

      • memory/4448-0-0x00007FFD38193000-0x00007FFD38195000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4448-1-0x0000000000430000-0x0000000000474000-memory.dmp

        Filesize

        272KB

        Download

      • memory/4448-3-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4448-4-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4448-9-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

        Filesize

        10.8MB

        Download