asyncrat | 5a47a9d3dbb16c5926f4a4a20dfc5b7d66a517ce257c74bf94efa7d543e4d467

Analysis

max time kernel
292s
max time network
291s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
24-10-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA.zip
Size

1.7MB
MD5

2746f5004ab0cc959b69442ca5004efa
SHA1

79b79fdb7f92e55baf1f917be82f7706cb652216
SHA256

5a47a9d3dbb16c5926f4a4a20dfc5b7d66a517ce257c74bf94efa7d543e4d467
SHA512

ece51951331623d3b555d87f6cb98b81c9da64cca5f6d7a514cb803bfc7360beec74e98f71636a0e7764a967d413932669ceddc956bcf330f639c9ebc7b8dea9
SSDEEP

49152:W6tBsqpFgpjll9UDVXm85GTaDgW6LOPg7DiQQZ4n3M:WuHkf6lCaDgInQL8

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

ansy21oct.duckdns.org:1415

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Executes dropped EXE 1 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.exe

pid process

2900 02 LEER NOTIFICACION ELECTRONIA.exe
Loads dropped DLL 3 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.exe

pid process

2900 02 LEER NOTIFICACION ELECTRONIA.exe
2900 02 LEER NOTIFICACION ELECTRONIA.exe
2900 02 LEER NOTIFICACION ELECTRONIA.exe

pid	process
2900	02 LEER NOTIFICACION ELECTRONIA.exe

pid	process
2900	02 LEER NOTIFICACION ELECTRONIA.exe
2900	02 LEER NOTIFICACION ELECTRONIA.exe
2900	02 LEER NOTIFICACION ELECTRONIA.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.execmd.exe

description	pid	process	target process
PID 2900 set thread context of 4980	2900	02 LEER NOTIFICACION ELECTRONIA.exe	cmd.exe
PID 4980 set thread context of 3192	4980	cmd.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

02 LEER NOTIFICACION ELECTRONIA.execmd.exeMSBuild.execmd.exetimeout.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02 LEER NOTIFICACION ELECTRONIA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4816 timeout.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.execmd.exe

pid process

2900 02 LEER NOTIFICACION ELECTRONIA.exe
2900 02 LEER NOTIFICACION ELECTRONIA.exe
4980 cmd.exe
4980 cmd.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.execmd.exe

pid process

2900 02 LEER NOTIFICACION ELECTRONIA.exe
4980 cmd.exe
4980 cmd.exe

pid	process
4816	timeout.exe

pid	process
2900	02 LEER NOTIFICACION ELECTRONIA.exe
2900	02 LEER NOTIFICACION ELECTRONIA.exe
4980	cmd.exe
4980	cmd.exe

pid	process
2900	02 LEER NOTIFICACION ELECTRONIA.exe
4980	cmd.exe
4980	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeMSBuild.exe

description	pid	process
Token: SeRestorePrivilege	4968	7zFM.exe
Token: 35	4968	7zFM.exe
Token: SeSecurityPrivilege	4968	7zFM.exe
Token: SeDebugPrivilege	3192	MSBuild.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

4968 7zFM.exe
4968 7zFM.exe

pid	process
4968	7zFM.exe
4968	7zFM.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

02 LEER NOTIFICACION ELECTRONIA.execmd.exeMSBuild.execmd.exe

description	pid	process	target process
PID 2900 wrote to memory of 4980	2900	02 LEER NOTIFICACION ELECTRONIA.exe	cmd.exe
PID 2900 wrote to memory of 4980	2900	02 LEER NOTIFICACION ELECTRONIA.exe	cmd.exe
PID 2900 wrote to memory of 4980	2900	02 LEER NOTIFICACION ELECTRONIA.exe	cmd.exe
PID 2900 wrote to memory of 4980	2900	02 LEER NOTIFICACION ELECTRONIA.exe	cmd.exe
PID 4980 wrote to memory of 3192	4980	cmd.exe	MSBuild.exe
PID 4980 wrote to memory of 3192	4980	cmd.exe	MSBuild.exe
PID 4980 wrote to memory of 3192	4980	cmd.exe	MSBuild.exe
PID 4980 wrote to memory of 3192	4980	cmd.exe	MSBuild.exe
PID 4980 wrote to memory of 3192	4980	cmd.exe	MSBuild.exe
PID 3192 wrote to memory of 3196	3192	MSBuild.exe	cmd.exe
PID 3192 wrote to memory of 3196	3192	MSBuild.exe	cmd.exe
PID 3192 wrote to memory of 3196	3192	MSBuild.exe	cmd.exe
PID 3196 wrote to memory of 4816	3196	cmd.exe	timeout.exe
PID 3196 wrote to memory of 4816	3196	cmd.exe	timeout.exe
PID 3196 wrote to memory of 4816	3196	cmd.exe	timeout.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3760

C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe
"C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE5D8.tmp.bat""
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196

C:\Windows\SysWOW64\timeout.exe
timeout 3
5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f7eed391

Filesize
777KB

MD5
da8ee1178c7e51cddca97f263a2c3052

SHA1
b3860fe9965293141004cd6011e0323a13d04fc0

SHA256
daf5a8979085d88bae8e7365fe530177141a06b877bd226a438d2bebf16db216

SHA512
1e24419ab6de0fbf5643d776ffd07a83a39916c2ecf8066c105710013b85a2781c7187bfad10929faacf19f90769e583698482bb94ea0d8dc71c31153903fc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5D8.tmp.bat

Filesize
171B

MD5
86e3f9d7b6d2504e3d4db9965bd302f0

SHA1
a498792c0427a491a27fe1580b0c0cfd7df7592a

SHA256
54255397dcfd64b6e334c7f5d6ac9d6b7f14d0e8527593c3da3da30dbe2403d7

SHA512
5e1ed94d441ba910c75ab85926bc35bf81cd520c9e954c7529ee12a89da2ee27c07bd8f75382ad747b66ddd550efc08a1a630dabf827efc5e4ab821fe794b002

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe

Filesize
1.2MB

MD5
f778e9136ab0db9de9802a7043de50a7

SHA1
850dca074534a14fdb9ada6afaceea88558764e0

SHA256
90803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a

SHA512
cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\AXE8SharedExpat.dll

Filesize
170KB

MD5
0cfb90c28768e26498834d780fbbd754

SHA1
94738b02338ac939ab610e69111f68a0b888da1d

SHA256
5b3434727cd6805870550c4912e23543d3f9b58a19d32c412b8978d1515e1229

SHA512
ff6f99a06a7f4bd02ca9d66568459dc9f584fdd140e9a1d1e426eb32152717d298b603d9e3aece0591fac0d951ab3225bb78a3665e3ac763319cb717135aac73

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\BIB.dll

Filesize
107KB

MD5
759d71fc9442ab5a9b5749c0f6c0c263

SHA1
07a68c6922d443eb9d6d445da18ae8a6d92f7ac6

SHA256
109647f58e7e8386a4c025f2c8175a4d638e5c0e62768953390764010ea22a2e

SHA512
e3efe66c76ea81285ba01b1978fdb3e807eb0bf2cfe0373bb6fef06f2fd7d9ddc3269acf0d87517cbf9bea5fa09b2703a03792491dc8265d26b724d7dca106c7

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\enwljq

Filesize
535KB

MD5
52d8723c67cdb08c33c1c07a584bbfec

SHA1
dadacd339557ce028035003b62850c191988f5ea

SHA256
9ea9353a6315ed0c4940033103cf56613fd7f47ff74be26eb98b8d158e9bab46

SHA512
c62a8c515f47e1bafd4307b9964ee95678d2b2c783af0d00ceab5107a6d3843c4466fa6e8451d1779d523282862a330a5574bdd06123ff79c83ef104d56e3d07

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcp90.dll

Filesize
557KB

MD5
90a32d8e07f7fb3d102eab1da28f0723

SHA1
0903911bbb5d00f68ba51895fa898b38a5453ded

SHA256
004ed24507dc7307cec1a3732fa57eabf19e918c3e1b54561e6cc01f554c0b77

SHA512
2c69586d5c5d2b4b5decf2bf479554c3d0ff5f5a6fbacb01b8583ea8d96d0ae9c850c30a0d43eb2ad1116be901578d15fe08fce3e505440c854082c208a79f1a

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcr90.dll

Filesize
638KB

MD5
11d49148a302de4104ded6a92b78b0ed

SHA1
fd58a091b39ed52611ade20a782ef58ac33012af

SHA256
ceb0947d898bc2a55a50f092f5ed3f7be64ac1cd4661022eefd3edd4029213b0

SHA512
fdc43b3ee38f7beb2375c953a29db8bcf66b73b78ccc04b147e26108f3b650c0a431b276853bb8e08167d34a8cc9c6b7918daef9ebc0a4833b1534c5afac75e4

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\rvfipgs

Filesize
71KB

MD5
547fb76d84d38e30ffd204fe105d1741

SHA1
5da798a9911f0f138340005c96d5ec26ca0a3285

SHA256
7cf51674e517f4c0e2e294f51370d906812250ddc5b6eba09d12683ecbe76777

SHA512
e3de8e08124b7ca111c234f3ad2aa9152ca21aade5534c5ea110698ecd48fdcba9679300a1ac1295e7b816748b9bf973366cd33f1e6e56230f690be95e7faeca

Download Submit
C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\sqlite.dll

Filesize
243KB

MD5
61c4af783de766cee0b3172b8acb02a7

SHA1
9396e8545da198e616e0d157f8bce399469e9627

SHA256
f6ed01358bc99993ed8bf2303995a6d6fbd4acefec99df35d347f51eef0c3fca

SHA512
b2d3f73c731d37eebe8bc8fb46ad02a592a192da6b9552fa223aded2203259c928495f249a106b37d3b8103515f9550b13397ee7e42dd8bca32127026612af72

Download Submit
memory/2900-27-0x00007FFD90220000-0x00007FFD90429000-memory.dmp

Filesize
2.0MB

Download
memory/2900-38-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download
memory/2900-39-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download
memory/2900-26-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download
memory/2900-37-0x0000000074B53000-0x0000000074B55000-memory.dmp

Filesize
8KB

Download
memory/3192-57-0x0000000005C30000-0x0000000005D32000-memory.dmp

Filesize
1.0MB

Download
memory/3192-47-0x0000000073530000-0x0000000074847000-memory.dmp

Filesize
19.1MB

Download
memory/3192-51-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download
memory/3192-54-0x0000000005390000-0x000000000542C000-memory.dmp

Filesize
624KB

Download
memory/3192-55-0x0000000005EE0000-0x0000000006486000-memory.dmp

Filesize
5.6MB

Download
memory/3192-56-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/3192-58-0x0000000006750000-0x00000000067C6000-memory.dmp

Filesize
472KB

Download
memory/3192-59-0x00000000066D0000-0x00000000066F4000-memory.dmp

Filesize
144KB

Download
memory/3192-60-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/4980-45-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download
memory/4980-50-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download
memory/4980-43-0x00007FFD90220000-0x00007FFD90429000-memory.dmp

Filesize
2.0MB

Download
memory/4980-41-0x0000000074B40000-0x0000000074CBD000-memory.dmp

Filesize
1.5MB

Download