Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-08-2024 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
-
Size
331KB
-
MD5
3a0a8189bb8910131bd13c098a1de18b
-
SHA1
600ff8878e9782ff7d3df847b379eca20d3e3bdd
-
SHA256
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5
-
SHA512
7c55c20d70f08b0c57390fc1decf1d26573c7e04738f1187e2ab3b8ecb0e3aebc06072f88724735828e114cad6592346c0c6b3a8db90c0b5765571fd5beefb6f
-
SSDEEP
6144:o2x6R9b8D6InoSbfVmEtpMMlRMH9O1BNI:o46R9b87noWYapMMlRMo7I
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
45.66.231.150:3232
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3504 created 3320 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 52 PID 3504 created 3320 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 52 -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2180-2-0x000001D79A260000-0x000001D79A276000-memory.dmp family_asyncrat -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2180 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82 PID 3504 wrote to memory of 2180 3504 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3504
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
-