Resubmissions

20/09/2024, 07:43 UTC

240920-jkdj5avhqa 10

16/09/2024, 13:49 UTC

240916-q4rz7a1apg 10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/09/2024, 13:49 UTC

General

  • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe

  • Size

    46KB

  • MD5

    305a2bab3acfb2a2ddc57f06a4b64471

  • SHA1

    357f18e24572b55b6270db3485f39b3a06278fd7

  • SHA256

    0f268e9be95d203c8d5cfa33d50ad7f623f13746bd97ec24703959dc08d97a9b

  • SHA512

    49be514325a15e7e132a98309f8645083d30d23ba4fb05b6487f691c3ee1336dd007d88b2ea644875b96bc8d725792c341ccf062485099a5e7243084e19e7b82

  • SSDEEP

    768:xqYVNZJrbXvkjjVKLUSQ1PkOicvHk3eHlWMPbPgF0qR55nhbej574rYI6OCu2tY:xkjV2UdXvZH0ub4Frddejx4l6ODKmVcn

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

192.168.1.7:8080

Mutex

cqtxddtxyigu

Attributes
  • delay

    5

  • install

    false

  • install_file

    GoogleCrashHandler.exe

  • install_folder

    %AppData%

aes.plain
1
DwI2IlCDbhVQ11RjArfYt2indAfv2nHR

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
    "C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5016

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    45.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    260 B
    5
  • 192.168.1.7:8080
    HEUR-Backdoor.MSIL.Crysan.exe
    156 B
    3
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    45.56.20.217.in-addr.arpa
    dns
    71 B
    131 B
    1
    1

    DNS Request

    45.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5016-0-0x00007FF9B30D3000-0x00007FF9B30D5000-memory.dmp

    Filesize

    8KB

  • memory/5016-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

    Filesize

    72KB

  • memory/5016-2-0x00007FF9B30D0000-0x00007FF9B3B91000-memory.dmp

    Filesize

    10.8MB

  • memory/5016-3-0x00007FF9B30D3000-0x00007FF9B30D5000-memory.dmp

    Filesize

    8KB

  • memory/5016-4-0x00007FF9B30D0000-0x00007FF9B3B91000-memory.dmp

    Filesize

    10.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.