Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 20:41
Behavioral task
behavioral1
Sample
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe
Resource
win7-20240903-en
General
-
Target
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe
-
Size
47KB
-
MD5
70c599d7fea4b5a29f7adae785ce9bf1
-
SHA1
46c508df2a683eb0b2b507badc214f8e6bf13b6a
-
SHA256
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a
-
SHA512
356a917c7e44a12f6a97551f907cfbd5b693ae19c7cdcb590c1691f0d4443bb3c5f56a246f5a1186ce3b6eaf5ce059047a95b3dfa2d925f470877873d4c2a09e
-
SSDEEP
768:xu6XdTvER+SWUk6P4mo2qbrtM2KOB4Jrd0PImLzzJs9D0bHrMgIvjzKxFojwQBDo:xu6XdTv2S2EtCdd5Uzz7bHrCKxa0GdMx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
WHXr1NLnlupn
-
delay
3
-
install
true
-
install_file
poop.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\poop.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
poop.exepid process 2680 poop.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2780 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeschtasks.execmd.exetimeout.exepoop.exe1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2768 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exepid process 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exepoop.exedescription pid process Token: SeDebugPrivilege 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe Token: SeDebugPrivilege 2680 poop.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.execmd.execmd.exedescription pid process target process PID 2136 wrote to memory of 2636 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2636 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2636 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2636 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2780 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2780 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2780 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2136 wrote to memory of 2780 2136 1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe cmd.exe PID 2636 wrote to memory of 2704 2636 cmd.exe schtasks.exe PID 2636 wrote to memory of 2704 2636 cmd.exe schtasks.exe PID 2636 wrote to memory of 2704 2636 cmd.exe schtasks.exe PID 2636 wrote to memory of 2704 2636 cmd.exe schtasks.exe PID 2780 wrote to memory of 2768 2780 cmd.exe timeout.exe PID 2780 wrote to memory of 2768 2780 cmd.exe timeout.exe PID 2780 wrote to memory of 2768 2780 cmd.exe timeout.exe PID 2780 wrote to memory of 2768 2780 cmd.exe timeout.exe PID 2780 wrote to memory of 2680 2780 cmd.exe poop.exe PID 2780 wrote to memory of 2680 2780 cmd.exe poop.exe PID 2780 wrote to memory of 2680 2780 cmd.exe poop.exe PID 2780 wrote to memory of 2680 2780 cmd.exe poop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe"C:\Users\Admin\AppData\Local\Temp\1dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "poop" /tr '"C:\Users\Admin\AppData\Roaming\poop.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "poop" /tr '"C:\Users\Admin\AppData\Roaming\poop.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE975.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2768 -
C:\Users\Admin\AppData\Roaming\poop.exe"C:\Users\Admin\AppData\Roaming\poop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5c3eb963f741c8600d63a295c08e791b0
SHA156e03c02f14b8e6ceedb7c746c39457bfe4a34c1
SHA256dd6d298253bdf6abb5a7d2251a06aa75d6785db3626e1565aefbba2943e078b0
SHA512761eaba234c3fc4c4e9e1c91c264f616bd0b65975f8fc127ceb480c2008513b1bd21aef95b4e57fcc67c1dc99274d1e9237e2af103bef673aac60f0ae52fc060
-
Filesize
47KB
MD570c599d7fea4b5a29f7adae785ce9bf1
SHA146c508df2a683eb0b2b507badc214f8e6bf13b6a
SHA2561dc3e04c25cce7028ef9f5b645dfa6cc113c8bb3bc92aeb7d8ecf547ce12579a
SHA512356a917c7e44a12f6a97551f907cfbd5b693ae19c7cdcb590c1691f0d4443bb3c5f56a246f5a1186ce3b6eaf5ce059047a95b3dfa2d925f470877873d4c2a09e