Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
-
submitted
08-08-2024 19:55
General
-
Target
1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe
-
Size
48KB
-
MD5
a4c35dcd0013a04666a9d58095ff4060
-
SHA1
8943579c1d6db5bb74322efec322a4a6a6c00723
-
SHA256
1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202
-
SHA512
7e63464b4bd2cbec56e7635c77a7bf15d2d8983b25e63e81b1f08ca202ca24252bf4de60b96e578885c284c64e5b85b4b373cb07fd4469fb8acf49c7d216c178
-
SSDEEP
768:zuifNTdFHLBWUZzGrmo2qrA75dsmegjs6Za3PIO6oIxlY0bsSVola1uFhHToCHbg:zuifNTdB+2Xegjs6MwODmTbscOnHTPa7
Malware Config
Extracted
asyncrat
0.5.7B
July 26
donzola.duckdns.org:2000
AsyncMutex_iuykt5yr5ur58n8tnur8herjncr8tk
-
delay
3
-
install
false
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe"C:\Users\Admin\AppData\Local\Temp\1f3c7379dd29298aa24b3aa3a3113ed3051f4515bc3c016893e285d311a74202.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:82945 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\SyncPush.odp" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
338B
MD5ef8a2be229af78cd5eefd4c463eccd83
SHA15a41b1831ef4b6cfc0f12a81eda4b24f86f48043
SHA256e5667538b9e5b320fb67fe93546c5d06a4c225159572e55b5c75aaf606d706dc
SHA512b92010363f9220aed92c0b64090265eff559e0faf71db6c1e3560f405370984dd85601fe1a4f76998c2f7e7d1bb30e3effa18718e1b24064b3cab5990e827800
-
Filesize
16KB
MD50d3d4fcbbd7696fced786412d6a08527
SHA1ab2f1245a05f5186d23616c4591a8980b15c9f5b
SHA256d9009aa5ba57b0017b41574d1809f511d34534211ff3876d6ab1ee73fb71b8b9
SHA512dc493d793b374d645fd89a540d32d207c791e4e048dd44bd46b5c76c6743535ac4c0740508dcd4f6d2b60ef9d503c345a449777b1808215a826e6c45eb4d7d21
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB