Analysis

  • max time kernel
    296s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 02:42

General

  • Target

    DEMANDA LABORAL/01DEMANDA LABORAL JDUCIAL.exe

  • Size

    3.1MB

  • MD5

    b841d408448f2a07f308ced1589e7673

  • SHA1

    f5b5095c0ed69d42110df6d39810d12b1fa32a1e

  • SHA256

    69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699

  • SHA512

    a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93

  • SSDEEP

    49152:pvFg5qg9BtIAHE3SM4ahx6LK2SamuZob+tCjNrv8:Jm5qGBHBLRKuZfkjNrv8

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

WAR

C2

warpower.dynuddns.net:7171

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3040

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\2c6fbf62

          Filesize

          780KB

          MD5

          00c75fb61939dbe00836f7b300e122de

          SHA1

          d0f999d988738d83b18cfc22527f0249599d9946

          SHA256

          716be13d9341e908a5f8b1cfc72f4855afd6e0644fdee524d47ea4f0d6451700

          SHA512

          e9ae49b626ae535204880f52a939d9a00dc2530bc3626800bcb73e5f614d4c5b26ab27c1ce5a17296fe71902cc44ce808202b0c92f1b1709ed0e0df96164e578

        • memory/2156-9-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2156-13-0x000000004A600000-0x000000004A6EC000-memory.dmp

          Filesize

          944KB

        • memory/2156-8-0x0000000074C13000-0x0000000074C15000-memory.dmp

          Filesize

          8KB

        • memory/2156-0-0x0000000000720000-0x000000000082B000-memory.dmp

          Filesize

          1.0MB

        • memory/2156-10-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2156-12-0x0000000000400000-0x0000000000711000-memory.dmp

          Filesize

          3.1MB

        • memory/2156-14-0x0000000000720000-0x000000000082B000-memory.dmp

          Filesize

          1.0MB

        • memory/2156-1-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2156-2-0x00000000778E0000-0x0000000077A89000-memory.dmp

          Filesize

          1.7MB

        • memory/2524-17-0x00000000778E0000-0x0000000077A89000-memory.dmp

          Filesize

          1.7MB

        • memory/2524-15-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2524-62-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2524-63-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/2524-66-0x0000000074C00000-0x0000000074D74000-memory.dmp

          Filesize

          1.5MB

        • memory/3040-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/3040-68-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/3040-65-0x0000000072E60000-0x0000000073EC2000-memory.dmp

          Filesize

          16.4MB

        • memory/3040-69-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB