Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 01:17
Static task
static1
1 signatures
General
-
Target
UPXTestExploit.exe
-
Size
6.7MB
-
MD5
4653a8b802ecbf40e98447fc20a85b05
-
SHA1
c4b807a30f01b94e7f6598079fc143d7f7a416f6
-
SHA256
6e1b04e05f85a908e441e21096a29dd2269f6f07ab3e7f90211a20456c3527cb
-
SHA512
d40e58fd63d29304ab4d8cd0f5c6892125d52d80659ce3a0b95d02d9f48c6603ac1887227ee5f5111cf74619097ab473c4d12e789c5e709775536da0e95fc419
-
SSDEEP
196608:TLcOVIK6bQI0IuNNJIgJHL2YMsWdvkhVuOPRMJu0:E0Db2YVEvkTuiz
Malware Config
Extracted
Family
asyncrat
Version
hookRAT / private
Botnet
1337
C2
147.185.221.16:56793
Mutex
aAFTorpq4fEa
Attributes
-
delay
3
-
install
false
-
install_file
Update.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1076-33-0x00000000225F0000-0x0000000022CB6000-memory.dmp disable_win_def -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3604 set thread context of 1076 3604 UPXTestExploit.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPXTestExploit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 3604 UPXTestExploit.exe 3604 UPXTestExploit.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2756 taskmgr.exe Token: SeSystemProfilePrivilege 2756 taskmgr.exe Token: SeCreateGlobalPrivilege 2756 taskmgr.exe Token: SeDebugPrivilege 3604 UPXTestExploit.exe Token: SeDebugPrivilege 1076 RegAsm.exe Token: 33 2756 taskmgr.exe Token: SeIncBasePriorityPrivilege 2756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3604 wrote to memory of 1020 3604 UPXTestExploit.exe 96 PID 3604 wrote to memory of 1020 3604 UPXTestExploit.exe 96 PID 3604 wrote to memory of 1020 3604 UPXTestExploit.exe 96 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97 PID 3604 wrote to memory of 1076 3604 UPXTestExploit.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\UPXTestExploit.exe"C:\Users\Admin\AppData\Local\Temp\UPXTestExploit.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵PID:1612