Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2024, 01:46

General

  • Target

    DEMANDA LABORAL/01DEMANDA LABORAL JDUCIAL.exe

  • Size

    3.1MB

  • MD5

    b841d408448f2a07f308ced1589e7673

  • SHA1

    f5b5095c0ed69d42110df6d39810d12b1fa32a1e

  • SHA256

    69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699

  • SHA512

    a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93

  • SSDEEP

    49152:pvFg5qg9BtIAHE3SM4ahx6LK2SamuZob+tCjNrv8:Jm5qGBHBLRKuZfkjNrv8

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

WAR

C2

warpower.dynuddns.net:7171

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B12.tmp.bat""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:4944

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\2381a800

          Filesize

          780KB

          MD5

          7e689509da21a51d637c470608c1fe17

          SHA1

          7067502eddd66908e6973e88628fce9baca75b3a

          SHA256

          6ad06ebf7d45e14fa5282293e334cb5f888faa8b2a28fef63f9563be40916695

          SHA512

          cb579d792f82a0c896690300429edb6401215ab8f22090469f39939a0c0daa38cf7ca31a0e113abf91de3c1ca2c6e16d75c5a9c0abfb977992589db8b0677312

        • C:\Users\Admin\AppData\Local\Temp\tmp9B12.tmp.bat

          Filesize

          171B

          MD5

          51d51e9bdc025c4cf203f0f748247c0d

          SHA1

          b4511b361f8093d468bb31ffea913f2dd94bfb10

          SHA256

          470f534168703a5103f7a91c4dc005c4f987f9b3fb33b3f2345483f76b0ff354

          SHA512

          7f045bb22d8ed271e1e7452971d4700351b71779460fb57546c3e688ec89619e2ac6b3d7d3cfe5ac76062a9876394b097c6d3b18cd2fcf71a77d5eaea5b17d32

        • memory/2068-0-0x0000000000CF0000-0x0000000000DFB000-memory.dmp

          Filesize

          1.0MB

        • memory/2068-1-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/2068-2-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

          Filesize

          2.0MB

        • memory/2068-8-0x0000000074283000-0x0000000074285000-memory.dmp

          Filesize

          8KB

        • memory/2068-9-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/2068-10-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/2068-14-0x0000000000CF0000-0x0000000000DFB000-memory.dmp

          Filesize

          1.0MB

        • memory/2068-12-0x0000000000400000-0x0000000000711000-memory.dmp

          Filesize

          3.1MB

        • memory/2068-13-0x000000004A600000-0x000000004A6EC000-memory.dmp

          Filesize

          944KB

        • memory/2840-26-0x00000000747CE000-0x00000000747CF000-memory.dmp

          Filesize

          4KB

        • memory/2840-34-0x00000000062B0000-0x000000000634C000-memory.dmp

          Filesize

          624KB

        • memory/2840-46-0x00000000747C0000-0x0000000074F70000-memory.dmp

          Filesize

          7.7MB

        • memory/2840-41-0x0000000006F70000-0x0000000006F96000-memory.dmp

          Filesize

          152KB

        • memory/2840-23-0x0000000072D40000-0x0000000073F94000-memory.dmp

          Filesize

          18.3MB

        • memory/2840-40-0x00000000747C0000-0x0000000074F70000-memory.dmp

          Filesize

          7.7MB

        • memory/2840-27-0x0000000000580000-0x0000000000596000-memory.dmp

          Filesize

          88KB

        • memory/2840-28-0x00000000747C0000-0x0000000074F70000-memory.dmp

          Filesize

          7.7MB

        • memory/2840-29-0x00000000056D0000-0x0000000005C74000-memory.dmp

          Filesize

          5.6MB

        • memory/2840-30-0x00000000052C0000-0x0000000005352000-memory.dmp

          Filesize

          584KB

        • memory/2840-31-0x0000000005280000-0x000000000528A000-memory.dmp

          Filesize

          40KB

        • memory/2840-39-0x0000000006D40000-0x0000000006D5E000-memory.dmp

          Filesize

          120KB

        • memory/2840-35-0x0000000006350000-0x00000000063B6000-memory.dmp

          Filesize

          408KB

        • memory/2840-36-0x00000000747CE000-0x00000000747CF000-memory.dmp

          Filesize

          4KB

        • memory/2840-37-0x0000000006CA0000-0x0000000006D16000-memory.dmp

          Filesize

          472KB

        • memory/2840-38-0x0000000006C20000-0x0000000006C48000-memory.dmp

          Filesize

          160KB

        • memory/3188-19-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/3188-17-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

          Filesize

          2.0MB

        • memory/3188-22-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/3188-20-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB

        • memory/3188-15-0x0000000074270000-0x00000000743EB000-memory.dmp

          Filesize

          1.5MB