Overview
overview
10Static
static
1282024-ENV...ON.exe
windows7-x64
10282024-ENV...ON.exe
windows10-2004-x64
10282024-ENV...c_.dll
windows7-x64
3282024-ENV...c_.dll
windows10-2004-x64
3282024-ENV...m_.dll
windows7-x64
3282024-ENV...m_.dll
windows10-2004-x64
3282024-ENV...t_.dll
windows7-x64
3282024-ENV...t_.dll
windows10-2004-x64
3282024-ENV...20.dll
windows7-x64
3282024-ENV...20.dll
windows10-2004-x64
3282024-ENV...20.dll
windows7-x64
3282024-ENV...20.dll
windows10-2004-x64
3Analysis
-
max time kernel
174s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 19:49
Static task
static1
Behavioral task
behavioral1
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/02 LEER NOTIFICACION.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/02 LEER NOTIFICACION.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/madbasic_.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/madbasic_.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/maddisAsm_.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/maddisAsm_.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/madexcept_.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/madexcept_.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/rtl120.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/rtl120.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/vcl120.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/vcl120.dll
Resource
win10v2004-20241007-en
General
-
Target
282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/02 LEER NOTIFICACION.exe
-
Size
163KB
-
MD5
0588ce0c39da3283e779c1d5b21d283b
-
SHA1
1f264a47972d63db2cde18dc8311bc46551380eb
-
SHA256
d5a6714ab95caa92ef1a712465a44c1827122b971bdb28ffa33221e07651d6f7
-
SHA512
a5f97ac156d081cb4d9b3f32948eea387725c88af0f19e8bc8db2058a19e211648b7fd86708ff5e1db8f7b57ca3ab8edeba771c9d684c53bcb228ca71adab02a
-
SSDEEP
3072:yK2FRsfrS8Ywp3GKJ7hDD/vRvDTX8QlevsqYau7j7/EecxurY:x1TSG/XT5Fau7pXk
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
envnue1024.duckdns.org:3013
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
02 LEER NOTIFICACION.execmd.exedescription pid process target process PID 2528 set thread context of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2880 set thread context of 1920 2880 cmd.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeMSBuild.exe02 LEER NOTIFICACION.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02 LEER NOTIFICACION.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
02 LEER NOTIFICACION.execmd.exepid process 2528 02 LEER NOTIFICACION.exe 2528 02 LEER NOTIFICACION.exe 2880 cmd.exe 2880 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
02 LEER NOTIFICACION.execmd.exepid process 2528 02 LEER NOTIFICACION.exe 2880 cmd.exe 2880 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1920 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
02 LEER NOTIFICACION.execmd.exedescription pid process target process PID 2528 wrote to memory of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2528 wrote to memory of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2528 wrote to memory of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2528 wrote to memory of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2528 wrote to memory of 2880 2528 02 LEER NOTIFICACION.exe cmd.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe PID 2880 wrote to memory of 1920 2880 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024\02 LEER NOTIFICACION.exe"C:\Users\Admin\AppData\Local\Temp\282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024\02 LEER NOTIFICACION.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777KB
MD5481c7bb178ca773e77f0a6c980380eee
SHA1dbb5795c93e79c398964020af3dce4d81dc739fb
SHA25695ac6391df7882604e2d63e989a85b1298995d0c295d97a3c60d3c771e8f6326
SHA512372cf83fba88950b3d40e6bce381b531fb4c1eb7dcbec3a7914507c828a5d5cf94738e8f5cd76aef20197fb9c4d75614a9157c566b2d570328431a08ebc12ba9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b