Overview
overview
10Static
static
1JUZGADO PE...IA.exe
windows7-x64
10JUZGADO PE...IA.exe
windows10-2004-x64
10JUZGADO PE...at.dll
windows7-x64
3JUZGADO PE...at.dll
windows10-2004-x64
3JUZGADO PE...IB.dll
windows7-x64
3JUZGADO PE...IB.dll
windows10-2004-x64
3JUZGADO PE...90.dll
windows7-x64
3JUZGADO PE...90.dll
windows10-2004-x64
3JUZGADO PE...90.dll
windows7-x64
3JUZGADO PE...90.dll
windows10-2004-x64
3JUZGADO PE...te.dll
windows7-x64
3JUZGADO PE...te.dll
windows10-2004-x64
3Analysis
-
max time kernel
67s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2024 09:21
Static task
static1
Behavioral task
behavioral1
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/1 PROCESO_AUDIENCIA.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/1 PROCESO_AUDIENCIA.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/AXE8SharedExpat.dll
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/AXE8SharedExpat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/BIB.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/BIB.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/msvcp90.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/msvcp90.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/msvcr90.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/msvcr90.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/sqlite.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/sqlite.dll
Resource
win10v2004-20241007-en
General
-
Target
JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/1 PROCESO_AUDIENCIA.exe
-
Size
1.2MB
-
MD5
f778e9136ab0db9de9802a7043de50a7
-
SHA1
850dca074534a14fdb9ada6afaceea88558764e0
-
SHA256
90803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a
-
SHA512
cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156
-
SSDEEP
24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
SERVER
asxyz.duckdns.org:52350
AsyncMutex_6SI6TOGjnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
1 PROCESO_AUDIENCIA.execmd.exedescription pid process target process PID 3996 set thread context of 2804 3996 1 PROCESO_AUDIENCIA.exe cmd.exe PID 2804 set thread context of 4448 2804 cmd.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1 PROCESO_AUDIENCIA.execmd.exeMSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1 PROCESO_AUDIENCIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1 PROCESO_AUDIENCIA.execmd.exepid process 3996 1 PROCESO_AUDIENCIA.exe 3996 1 PROCESO_AUDIENCIA.exe 2804 cmd.exe 2804 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
1 PROCESO_AUDIENCIA.execmd.exepid process 3996 1 PROCESO_AUDIENCIA.exe 2804 cmd.exe 2804 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4448 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1 PROCESO_AUDIENCIA.execmd.exedescription pid process target process PID 3996 wrote to memory of 2804 3996 1 PROCESO_AUDIENCIA.exe cmd.exe PID 3996 wrote to memory of 2804 3996 1 PROCESO_AUDIENCIA.exe cmd.exe PID 3996 wrote to memory of 2804 3996 1 PROCESO_AUDIENCIA.exe cmd.exe PID 3996 wrote to memory of 2804 3996 1 PROCESO_AUDIENCIA.exe cmd.exe PID 2804 wrote to memory of 4448 2804 cmd.exe MSBuild.exe PID 2804 wrote to memory of 4448 2804 cmd.exe MSBuild.exe PID 2804 wrote to memory of 4448 2804 cmd.exe MSBuild.exe PID 2804 wrote to memory of 4448 2804 cmd.exe MSBuild.exe PID 2804 wrote to memory of 4448 2804 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL\1 PROCESO_AUDIENCIA.exe"C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL\1 PROCESO_AUDIENCIA.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777KB
MD53286fb7d9c24432a1420eb28256e67f0
SHA1453ca53bded844be39643ab3d5e9f8c35f240259
SHA2563011918aff3ca8067d8fd2b8579bad078351b3f5f10718fd4801c5a30bdc6651
SHA51286c8a2dfceaf0dc239c120c90cc16acf887ec2e5ba8cc1130f35193384884e606ea8a8678f5ef6e7c4bd36959754f8faf74ecd4938eb494a915f147a12e5ba85