Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 03:15

General

  • Target

    a52d0c834a09cc7efdfe374ee2f4f90e_JaffaCakes118.exe

  • Size

    380KB

  • MD5

    a52d0c834a09cc7efdfe374ee2f4f90e

  • SHA1

    5957da57c40aef542a52d07df04501f74b631bdb

  • SHA256

    aaf00e1348307208d3415f629193cdf125171170a32a8cdeb140e8373d079714

  • SHA512

    e99e1429dcac7398473cecb4a63cce2ac1b0bccb2f4dd284e38c1ca16dac21d0d6552c886604c87fe79590274ea821734faf874639f873883a75e0d4d5a247e8

  • SSDEEP

    6144:hBUl1fcf0Tv2sbP6mSPmFFLmlrqQroarJ0zUWZyzhX:Q79vnz6mSQYxkarJaZyzh

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

severdops.ddns.net:6204

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a52d0c834a09cc7efdfe374ee2f4f90e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a52d0c834a09cc7efdfe374ee2f4f90e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eKLGqzBRYkTEB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D9C.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2836
    • C:\Users\Admin\AppData\Local\Temp\a52d0c834a09cc7efdfe374ee2f4f90e_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a52d0c834a09cc7efdfe374ee2f4f90e_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp3D9C.tmp

    Filesize

    1KB

    MD5

    15dc6770830c1a0bca362e56e4badcfc

    SHA1

    0c16d8ef7bf73ab68040f34146830548c33d5cf9

    SHA256

    da4f19953799f9f92bf97fab9297b7744f19f0fac14f818fad936a7369e1092a

    SHA512

    ae6cc97c34bad437d03bb35c0cc8dcec12ee64109ddadd9139ea8a789b74446db9945962dab92729b02c1bced5e457cd350db36f6425a069887aa75de0d85fe1

  • memory/1544-0-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1544-1-0x0000000000990000-0x00000000009F4000-memory.dmp

    Filesize

    400KB

  • memory/1544-2-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/1544-3-0x0000000000980000-0x000000000098A000-memory.dmp

    Filesize

    40KB

  • memory/1544-4-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1544-5-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/1544-6-0x0000000004720000-0x0000000004760000-memory.dmp

    Filesize

    256KB

  • memory/1544-26-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2936-20-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-16-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-15-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-14-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-25-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-22-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-12-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2936-27-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-28-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-29-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-30-0x0000000074620000-0x0000000074D0E000-memory.dmp

    Filesize

    6.9MB