Analysis

  • max time kernel
    292s
  • max time network
    291s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-es
  • resource tags

    arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    24-10-2024 16:25

General

  • Target

    00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA.zip

  • Size

    1.7MB

  • MD5

    2746f5004ab0cc959b69442ca5004efa

  • SHA1

    79b79fdb7f92e55baf1f917be82f7706cb652216

  • SHA256

    5a47a9d3dbb16c5926f4a4a20dfc5b7d66a517ce257c74bf94efa7d543e4d467

  • SHA512

    ece51951331623d3b555d87f6cb98b81c9da64cca5f6d7a514cb803bfc7360beec74e98f71636a0e7764a967d413932669ceddc956bcf330f639c9ebc7b8dea9

  • SSDEEP

    49152:W6tBsqpFgpjll9UDVXm85GTaDgW6LOPg7DiQQZ4n3M:WuHkf6lCaDgInQL8

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

ansy21oct.duckdns.org:1415

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA.zip"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4968
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3760
    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe
      "C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3192
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE5D8.tmp.bat""
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3196
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              5⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:4816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\f7eed391

      Filesize

      777KB

      MD5

      da8ee1178c7e51cddca97f263a2c3052

      SHA1

      b3860fe9965293141004cd6011e0323a13d04fc0

      SHA256

      daf5a8979085d88bae8e7365fe530177141a06b877bd226a438d2bebf16db216

      SHA512

      1e24419ab6de0fbf5643d776ffd07a83a39916c2ecf8066c105710013b85a2781c7187bfad10929faacf19f90769e583698482bb94ea0d8dc71c31153903fc90

    • C:\Users\Admin\AppData\Local\Temp\tmpE5D8.tmp.bat

      Filesize

      171B

      MD5

      86e3f9d7b6d2504e3d4db9965bd302f0

      SHA1

      a498792c0427a491a27fe1580b0c0cfd7df7592a

      SHA256

      54255397dcfd64b6e334c7f5d6ac9d6b7f14d0e8527593c3da3da30dbe2403d7

      SHA512

      5e1ed94d441ba910c75ab85926bc35bf81cd520c9e954c7529ee12a89da2ee27c07bd8f75382ad747b66ddd550efc08a1a630dabf827efc5e4ab821fe794b002

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe

      Filesize

      1.2MB

      MD5

      f778e9136ab0db9de9802a7043de50a7

      SHA1

      850dca074534a14fdb9ada6afaceea88558764e0

      SHA256

      90803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a

      SHA512

      cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\AXE8SharedExpat.dll

      Filesize

      170KB

      MD5

      0cfb90c28768e26498834d780fbbd754

      SHA1

      94738b02338ac939ab610e69111f68a0b888da1d

      SHA256

      5b3434727cd6805870550c4912e23543d3f9b58a19d32c412b8978d1515e1229

      SHA512

      ff6f99a06a7f4bd02ca9d66568459dc9f584fdd140e9a1d1e426eb32152717d298b603d9e3aece0591fac0d951ab3225bb78a3665e3ac763319cb717135aac73

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\BIB.dll

      Filesize

      107KB

      MD5

      759d71fc9442ab5a9b5749c0f6c0c263

      SHA1

      07a68c6922d443eb9d6d445da18ae8a6d92f7ac6

      SHA256

      109647f58e7e8386a4c025f2c8175a4d638e5c0e62768953390764010ea22a2e

      SHA512

      e3efe66c76ea81285ba01b1978fdb3e807eb0bf2cfe0373bb6fef06f2fd7d9ddc3269acf0d87517cbf9bea5fa09b2703a03792491dc8265d26b724d7dca106c7

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\enwljq

      Filesize

      535KB

      MD5

      52d8723c67cdb08c33c1c07a584bbfec

      SHA1

      dadacd339557ce028035003b62850c191988f5ea

      SHA256

      9ea9353a6315ed0c4940033103cf56613fd7f47ff74be26eb98b8d158e9bab46

      SHA512

      c62a8c515f47e1bafd4307b9964ee95678d2b2c783af0d00ceab5107a6d3843c4466fa6e8451d1779d523282862a330a5574bdd06123ff79c83ef104d56e3d07

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcp90.dll

      Filesize

      557KB

      MD5

      90a32d8e07f7fb3d102eab1da28f0723

      SHA1

      0903911bbb5d00f68ba51895fa898b38a5453ded

      SHA256

      004ed24507dc7307cec1a3732fa57eabf19e918c3e1b54561e6cc01f554c0b77

      SHA512

      2c69586d5c5d2b4b5decf2bf479554c3d0ff5f5a6fbacb01b8583ea8d96d0ae9c850c30a0d43eb2ad1116be901578d15fe08fce3e505440c854082c208a79f1a

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcr90.dll

      Filesize

      638KB

      MD5

      11d49148a302de4104ded6a92b78b0ed

      SHA1

      fd58a091b39ed52611ade20a782ef58ac33012af

      SHA256

      ceb0947d898bc2a55a50f092f5ed3f7be64ac1cd4661022eefd3edd4029213b0

      SHA512

      fdc43b3ee38f7beb2375c953a29db8bcf66b73b78ccc04b147e26108f3b650c0a431b276853bb8e08167d34a8cc9c6b7918daef9ebc0a4833b1534c5afac75e4

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\rvfipgs

      Filesize

      71KB

      MD5

      547fb76d84d38e30ffd204fe105d1741

      SHA1

      5da798a9911f0f138340005c96d5ec26ca0a3285

      SHA256

      7cf51674e517f4c0e2e294f51370d906812250ddc5b6eba09d12683ecbe76777

      SHA512

      e3de8e08124b7ca111c234f3ad2aa9152ca21aade5534c5ea110698ecd48fdcba9679300a1ac1295e7b816748b9bf973366cd33f1e6e56230f690be95e7faeca

    • C:\Users\Admin\Desktop\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\sqlite.dll

      Filesize

      243KB

      MD5

      61c4af783de766cee0b3172b8acb02a7

      SHA1

      9396e8545da198e616e0d157f8bce399469e9627

      SHA256

      f6ed01358bc99993ed8bf2303995a6d6fbd4acefec99df35d347f51eef0c3fca

      SHA512

      b2d3f73c731d37eebe8bc8fb46ad02a592a192da6b9552fa223aded2203259c928495f249a106b37d3b8103515f9550b13397ee7e42dd8bca32127026612af72

    • memory/2900-27-0x00007FFD90220000-0x00007FFD90429000-memory.dmp

      Filesize

      2.0MB

    • memory/2900-38-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB

    • memory/2900-39-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB

    • memory/2900-26-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB

    • memory/2900-37-0x0000000074B53000-0x0000000074B55000-memory.dmp

      Filesize

      8KB

    • memory/3192-57-0x0000000005C30000-0x0000000005D32000-memory.dmp

      Filesize

      1.0MB

    • memory/3192-47-0x0000000073530000-0x0000000074847000-memory.dmp

      Filesize

      19.1MB

    • memory/3192-51-0x00000000003C0000-0x00000000003D6000-memory.dmp

      Filesize

      88KB

    • memory/3192-54-0x0000000005390000-0x000000000542C000-memory.dmp

      Filesize

      624KB

    • memory/3192-55-0x0000000005EE0000-0x0000000006486000-memory.dmp

      Filesize

      5.6MB

    • memory/3192-56-0x00000000059A0000-0x0000000005A06000-memory.dmp

      Filesize

      408KB

    • memory/3192-58-0x0000000006750000-0x00000000067C6000-memory.dmp

      Filesize

      472KB

    • memory/3192-59-0x00000000066D0000-0x00000000066F4000-memory.dmp

      Filesize

      144KB

    • memory/3192-60-0x00000000067D0000-0x00000000067EE000-memory.dmp

      Filesize

      120KB

    • memory/4980-45-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB

    • memory/4980-50-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB

    • memory/4980-43-0x00007FFD90220000-0x00007FFD90429000-memory.dmp

      Filesize

      2.0MB

    • memory/4980-41-0x0000000074B40000-0x0000000074CBD000-memory.dmp

      Filesize

      1.5MB