Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 01:42
Behavioral task
behavioral1
Sample
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe
Resource
win10v2004-20241007-en
General
-
Target
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe
-
Size
63KB
-
MD5
9eb074e0713a33f7a6e499b0fbf2484c
-
SHA1
132ca59a5fb654c3d0794f92f05eaf43e3a7af94
-
SHA256
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1
-
SHA512
367fbbf6f058ef21367e329c8b0373d482c9c97dfbb42a67b17c9b1dc1d0139ae879c8ddb87b0960c5545746610d2c5690343abb458818c2dea9dbca66f39794
-
SSDEEP
1536:JKh54k58k/GWZOKuvUYFgF4yY5biArLdcKgtiCrITGFx:JK/4k58kAKuvUYFgF4yY5bikcltiCOGx
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
SolaraFake
anyone-blogging.gl.at.ply.gg:22284
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Windows.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Windows.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid process 5040 Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.exeschtasks.exetimeout.exeWindows.exe519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2324 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exepid process 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exeWindows.exedescription pid process Token: SeDebugPrivilege 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe Token: SeDebugPrivilege 5040 Windows.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.execmd.execmd.exedescription pid process target process PID 2504 wrote to memory of 4052 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 2504 wrote to memory of 4052 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 2504 wrote to memory of 4052 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 2504 wrote to memory of 808 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 2504 wrote to memory of 808 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 2504 wrote to memory of 808 2504 519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe cmd.exe PID 4052 wrote to memory of 3580 4052 cmd.exe schtasks.exe PID 4052 wrote to memory of 3580 4052 cmd.exe schtasks.exe PID 4052 wrote to memory of 3580 4052 cmd.exe schtasks.exe PID 808 wrote to memory of 2324 808 cmd.exe timeout.exe PID 808 wrote to memory of 2324 808 cmd.exe timeout.exe PID 808 wrote to memory of 2324 808 cmd.exe timeout.exe PID 808 wrote to memory of 5040 808 cmd.exe Windows.exe PID 808 wrote to memory of 5040 808 cmd.exe Windows.exe PID 808 wrote to memory of 5040 808 cmd.exe Windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe"C:\Users\Admin\AppData\Local\Temp\519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Local\Temp\Windows.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDEF6.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Windows.exe"C:\Users\Admin\AppData\Local\Temp\Windows.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD59eb074e0713a33f7a6e499b0fbf2484c
SHA1132ca59a5fb654c3d0794f92f05eaf43e3a7af94
SHA256519f3ceedba4471f3d5178451c1007911145fb6eaf4e259a2c29b8e3483dabb1
SHA512367fbbf6f058ef21367e329c8b0373d482c9c97dfbb42a67b17c9b1dc1d0139ae879c8ddb87b0960c5545746610d2c5690343abb458818c2dea9dbca66f39794
-
Filesize
154B
MD57879fa71f57852cb46f2d63e765ee4ad
SHA1237697a6c0821dfe5d08c7683c733b366106c44b
SHA2562c6a66003da60941988fed8c798749d622429a0c37324018451b1df76043e1ca
SHA512586fc4186b3ed08cf1fe7410f393b93df2025555d5b71883ac5877cf024a9a06efdc41422d0b9fd14b534e217052f1a47ea400be05dd91b2fd82de9919df03f6