a1542df0b61bc06f0bc1cc4580a49872c88a01dffd9609932d57daa8bd6986a6

Analysis

max time kernel
14s
max time network
26s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AsteroidPC.dll
Size

5.1MB
MD5

0586300ac1cad9158caff136d5cb614f
SHA1

0563b3f16160bdea082632456cc502394b32216f
SHA256

d6e8e726dfffc713a4b05b98a821f6b21bd99f0599e21bc8e49090ac6fac03ae
SHA512

057e759c970ec099cf0e1ccf1474fc7b5def4f44bb4d2fd6432c677ca6f400b3b44f0067e37d264db253cd81401d2fbf1b77c15646ceb1d88c6748d4c7721a33
SSDEEP

98304:kV+Y5dE9K45gYEGoLw3zuh0yTQzLVKxGbErmh2R:QR5WK45dEhM3zuh0yTQzLQxInI

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
16	discord.com
17	discord.com
18	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe
Token: SeShutdownPrivilege	2964	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3008	2964	chrome.exe	32
PID 2964 wrote to memory of 3008	2964	chrome.exe	32
PID 2964 wrote to memory of 3008	2964	chrome.exe	32
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2804	2964	chrome.exe	34
PID 2964 wrote to memory of 2908	2964	chrome.exe	35
PID 2964 wrote to memory of 2908	2964	chrome.exe	35
PID 2964 wrote to memory of 2908	2964	chrome.exe	35
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36
PID 2964 wrote to memory of 1276	2964	chrome.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AsteroidPC.dll,#1
1⤵
PID:1688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72e9758,0x7fef72e9768,0x7fef72e9778
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1432 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1320 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3800 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2636 --field-trial-handle=1380,i,9946130953578043734,4779588530463199711,131072 /prefetch:8
  2⤵
  PID:1548

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
6d6a26614cd8065d319180d9c81ad282

SHA1
a38d5c5bee828e5276a62cbf01356e1ce720adec

SHA256
69ef458df4f6d1fda150655efbf8d4e240764411800123e70752fbdc25c45e52

SHA512
fcb63b547befbd4be944fb0f42f06ecd2a3fdcbf6a8614e162769a8877371f070a7ff3f24067648934f9ada4d2fc6ff428213b118d2cbe74a3b23eebfb80b638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c82cd24d8385fe735db5c21949d03e0e

SHA1
6327049760a2a7f623d4e0773810fbecea79ec35

SHA256
6fbbfaa7172ee501847dab922868878d375356f26938001aae84351aa2a9536f

SHA512
f76fe5788c82d263e7c2f4cb943354ad0881b5f6805708d84c7a63c8f0cfa3d3482cd4591fabf7fc2bcce3040c6d89c00e23720b9282ef0bdfdea7b1b3ef3416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a419e9682eeaafc9fab2e53c56e175

SHA1
4e336c925d9a0a45b5b4d0d645848aa29d81c251

SHA256
7234cb791405c73259bbc3ca3e21623d59ddd765126da8dd5b023f3094a0900a

SHA512
03508f33f9febd3551accd7af076b942eeab3dcdc126adcb4aa7705db21f7abf6258b47c7cef96239fd489df602039beaa7af6d729ed6108d5faaae1f3f8ccc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
335KB

MD5
a9d357d825cb17d5166742d408482750

SHA1
f6dbb4fe9a00b13fdef5769a94352cc7115fc612

SHA256
299402cf05279ed9bbd2127c72882c9b63893365aafab62368360e376383867e

SHA512
b15235e6ba5a26b2cc81d4df6eb838f0406d54ac3f868bcaa0c970f082ffef1b766d625708a234c3d57933f5c954f33f703c79bcdb04ec16aa8607a02528f32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3304.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3326.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit