Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 20:36
Behavioral task
behavioral1
Sample
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe
Resource
win7-20241010-en
General
-
Target
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe
-
Size
47KB
-
MD5
70c599d7fea4b5a29f7adae785ce9bf1
-
SHA1
46c508df2a683eb0b2b507badc214f8e6bf13b6a
-
SHA256
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a
-
SHA512
356a917c7e44a12f6a97551f907cfbd5b693ae19c7cdcb590c1691f0d4443bb3c5f56a246f5a1186ce3b6eaf5ce059047a95b3dfa2d925f470877873d4c2a09e
-
SSDEEP
768:xu6XdTvER+SWUk6P4mo2qbrtM2KOB4Jrd0PImLzzJs9D0bHrMgIvjzKxFojwQBDo:xu6XdTv2S2EtCdd5Uzz7bHrCKxa0GdMx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
WHXr1NLnlupn
-
delay
3
-
install
true
-
install_file
poop.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\poop.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
poop.exepid process 2692 poop.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2944 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
poop.exe1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.execmd.execmd.exetimeout.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1752 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exepid process 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exepoop.exedescription pid process Token: SeDebugPrivilege 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe Token: SeDebugPrivilege 2692 poop.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.execmd.execmd.exedescription pid process target process PID 564 wrote to memory of 2684 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2684 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2684 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2684 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2944 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2944 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2944 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 564 wrote to memory of 2944 564 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2684 wrote to memory of 1676 2684 cmd.exe schtasks.exe PID 2684 wrote to memory of 1676 2684 cmd.exe schtasks.exe PID 2684 wrote to memory of 1676 2684 cmd.exe schtasks.exe PID 2684 wrote to memory of 1676 2684 cmd.exe schtasks.exe PID 2944 wrote to memory of 1752 2944 cmd.exe timeout.exe PID 2944 wrote to memory of 1752 2944 cmd.exe timeout.exe PID 2944 wrote to memory of 1752 2944 cmd.exe timeout.exe PID 2944 wrote to memory of 1752 2944 cmd.exe timeout.exe PID 2944 wrote to memory of 2692 2944 cmd.exe poop.exe PID 2944 wrote to memory of 2692 2944 cmd.exe poop.exe PID 2944 wrote to memory of 2692 2944 cmd.exe poop.exe PID 2944 wrote to memory of 2692 2944 cmd.exe poop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe"C:\Users\Admin\AppData\Local\Temp\1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "poop" /tr '"C:\Users\Admin\AppData\Roaming\poop.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "poop" /tr '"C:\Users\Admin\AppData\Roaming\poop.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp902F.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1752 -
C:\Users\Admin\AppData\Roaming\poop.exe"C:\Users\Admin\AppData\Roaming\poop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5dfc64795ae80d8df0d9b8c93bf4ba4a9
SHA1b18323fd1381e6c84d0e335b747100e59bc6d578
SHA25682a3abb557ad8f957760d48bb90a24cce6b5944a56b28327047b73894b0e8fa2
SHA5121ba0988c88e8c1309bc2c18d8a832886ac520a1ee97d7e5f8128263d37d5678403f8654e614c0f6fbb876f94ceef18dfcc82708e4f47a3005c6c21d05e47fd70
-
Filesize
47KB
MD570c599d7fea4b5a29f7adae785ce9bf1
SHA146c508df2a683eb0b2b507badc214f8e6bf13b6a
SHA2561dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a
SHA512356a917c7e44a12f6a97551f907cfbd5b693ae19c7cdcb590c1691f0d4443bb3c5f56a246f5a1186ce3b6eaf5ce059047a95b3dfa2d925f470877873d4c2a09e