Analysis

  • max time kernel
    276s
  • max time network
    280s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-es
  • resource tags

    arch:x64arch:x86image:win11-20241023-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    24-10-2024 16:25

General

  • Target

    00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA/02 LEER NOTIFICACION ELECTRONIA.exe

  • Size

    1.2MB

  • MD5

    f778e9136ab0db9de9802a7043de50a7

  • SHA1

    850dca074534a14fdb9ada6afaceea88558764e0

  • SHA256

    90803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a

  • SHA512

    cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156

  • SSDEEP

    24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

ansy21oct.duckdns.org:1415

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe
    "C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\02 LEER NOTIFICACION ELECTRONIA.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp353.tmp.bat""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:4460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\231cb2bc

    Filesize

    777KB

    MD5

    df6227ef226b17de139625c6969e72b4

    SHA1

    b0a44c64f874ec226398e5e0615519cca50d8daa

    SHA256

    41f36f5ed3aa9d24614df31b52f44083a4b020178dcb48197e579d6c97d83028

    SHA512

    87f200d19c45f0b6a7e37730649805c8abb091f93c58c4666d0516d2bff291442c5930565cb00c1ee9d56a56213ec3c1768f8eb0ac40d05586e6bcbdaac1b1c5

  • C:\Users\Admin\AppData\Local\Temp\tmp353.tmp.bat

    Filesize

    170B

    MD5

    d6b143fd1c6892e07fde1dbe04bcb715

    SHA1

    2c85e5b1126fce4bf6d2f20632f95a6f0b619285

    SHA256

    ef14c5dff431fe57721ab478cb3ec7ed8bdb9d5797ef0c91835125d6debba888

    SHA512

    ec66fb7120cfb78976ce44c99b1a5bde9a690dc86ad3537225c6a258a947530e0c1a826eb834287dedfbee8ac5af03a6c7f2a543845d06b4b63af607623f7515

  • memory/2440-13-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/2440-15-0x00007FF9E6C40000-0x00007FF9E6E49000-memory.dmp

    Filesize

    2.0MB

  • memory/2440-18-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/2440-19-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/2440-21-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/4764-0-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/4764-1-0x00007FF9E6C40000-0x00007FF9E6E49000-memory.dmp

    Filesize

    2.0MB

  • memory/4764-9-0x0000000074A83000-0x0000000074A85000-memory.dmp

    Filesize

    8KB

  • memory/4764-10-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/4764-11-0x0000000074A70000-0x0000000074BED000-memory.dmp

    Filesize

    1.5MB

  • memory/4812-25-0x0000000072CAE000-0x0000000072CAF000-memory.dmp

    Filesize

    4KB

  • memory/4812-32-0x0000000072CAE000-0x0000000072CAF000-memory.dmp

    Filesize

    4KB

  • memory/4812-27-0x0000000072CA0000-0x0000000073451000-memory.dmp

    Filesize

    7.7MB

  • memory/4812-28-0x00000000057E0000-0x000000000587C000-memory.dmp

    Filesize

    624KB

  • memory/4812-29-0x0000000005E30000-0x00000000063D6000-memory.dmp

    Filesize

    5.6MB

  • memory/4812-30-0x00000000058F0000-0x0000000005956000-memory.dmp

    Filesize

    408KB

  • memory/4812-31-0x00000000063E0000-0x00000000064E2000-memory.dmp

    Filesize

    1.0MB

  • memory/4812-26-0x0000000000C10000-0x0000000000C26000-memory.dmp

    Filesize

    88KB

  • memory/4812-33-0x0000000072CA0000-0x0000000073451000-memory.dmp

    Filesize

    7.7MB

  • memory/4812-34-0x0000000005D60000-0x0000000005DD6000-memory.dmp

    Filesize

    472KB

  • memory/4812-35-0x0000000005AE0000-0x0000000005B04000-memory.dmp

    Filesize

    144KB

  • memory/4812-36-0x0000000006A70000-0x0000000006A8E000-memory.dmp

    Filesize

    120KB

  • memory/4812-22-0x0000000073460000-0x0000000074777000-memory.dmp

    Filesize

    19.1MB

  • memory/4812-41-0x0000000072CA0000-0x0000000073451000-memory.dmp

    Filesize

    7.7MB