Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 03:05
Behavioral task
behavioral1
Sample
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe
Resource
win7-20241010-en
General
-
Target
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe
-
Size
48KB
-
MD5
89e08f42736cac8b697ffda76d4f2d73
-
SHA1
f51cfed16178cb0baeb89a3e86a3d0d4c663d70e
-
SHA256
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1
-
SHA512
d8d073e467a54b2556015702d49af91c68f0febf2d61247f9a9c54e9ebcaa7099446f99a3c70349e4a629a46dba2796bdc78f54e9a692166cd11bd8cf43dd69d
-
SSDEEP
768:quqJ1TUo0+Q4WUmmjSmo2qMk9h1qpzm/kPI5V5YDZeU0bL28s189HX6PEW/haoyp:quqJ1TU2e2yam/J5V5Y8bL25UHKceHdM
Malware Config
Extracted
asyncrat
0.5.8
Default
37.112.34.178:1070
gnRQgC1xq8fz
-
delay
3
-
install
true
-
install_file
MoUsoCoreWorker.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\MoUsoCoreWorker.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe -
Executes dropped EXE 1 IoCs
Processes:
MoUsoCoreWorker.exepid process 4540 MoUsoCoreWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MoUsoCoreWorker.execab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.execmd.execmd.exeschtasks.exetimeout.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MoUsoCoreWorker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3664 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exepid process 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exeMoUsoCoreWorker.exedescription pid process Token: SeDebugPrivilege 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe Token: SeDebugPrivilege 4540 MoUsoCoreWorker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.execmd.execmd.exedescription pid process target process PID 3580 wrote to memory of 4308 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 3580 wrote to memory of 4308 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 3580 wrote to memory of 4308 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 3580 wrote to memory of 2812 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 3580 wrote to memory of 2812 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 3580 wrote to memory of 2812 3580 cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe cmd.exe PID 4308 wrote to memory of 944 4308 cmd.exe schtasks.exe PID 4308 wrote to memory of 944 4308 cmd.exe schtasks.exe PID 4308 wrote to memory of 944 4308 cmd.exe schtasks.exe PID 2812 wrote to memory of 3664 2812 cmd.exe timeout.exe PID 2812 wrote to memory of 3664 2812 cmd.exe timeout.exe PID 2812 wrote to memory of 3664 2812 cmd.exe timeout.exe PID 2812 wrote to memory of 4540 2812 cmd.exe MoUsoCoreWorker.exe PID 2812 wrote to memory of 4540 2812 cmd.exe MoUsoCoreWorker.exe PID 2812 wrote to memory of 4540 2812 cmd.exe MoUsoCoreWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe"C:\Users\Admin\AppData\Local\Temp\cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "MoUsoCoreWorker" /tr '"C:\Users\Admin\AppData\Roaming\MoUsoCoreWorker.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "MoUsoCoreWorker" /tr '"C:\Users\Admin\AppData\Roaming\MoUsoCoreWorker.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp83D6.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3664 -
C:\Users\Admin\AppData\Roaming\MoUsoCoreWorker.exe"C:\Users\Admin\AppData\Roaming\MoUsoCoreWorker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159B
MD5e6444e2176f710acead5013e7aa75158
SHA1e14eecde7c785da09911a2e0fc6f905e3b21064f
SHA2568da6b2e508f31be64419ad82362581dcae0533c0072b8581366794e8838bf1d9
SHA51223cbc4a81fc7dbacf8f1371c51241a2fe482cb8365188d279e0144dc62d2fa3be38e8ca5b8d6b64f442867cdcfabe9f5a51e5c26f60434d025404270a9eacbc2
-
Filesize
48KB
MD589e08f42736cac8b697ffda76d4f2d73
SHA1f51cfed16178cb0baeb89a3e86a3d0d4c663d70e
SHA256cab2ada39e0f2598b71fcc7285104fd686395c9c38dc4a307d0fb104578a04a1
SHA512d8d073e467a54b2556015702d49af91c68f0febf2d61247f9a9c54e9ebcaa7099446f99a3c70349e4a629a46dba2796bdc78f54e9a692166cd11bd8cf43dd69d