Analysis

  • max time kernel
    296s
  • max time network
    301s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 02:42

General

  • Target

    DEMANDA LABORAL/01DEMANDA LABORAL JDUCIAL.exe

  • Size

    3.1MB

  • MD5

    b841d408448f2a07f308ced1589e7673

  • SHA1

    f5b5095c0ed69d42110df6d39810d12b1fa32a1e

  • SHA256

    69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699

  • SHA512

    a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93

  • SSDEEP

    49152:pvFg5qg9BtIAHE3SM4ahx6LK2SamuZob+tCjNrv8:Jm5qGBHBLRKuZfkjNrv8

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

WAR

C2

warpower.dynuddns.net:7171

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\01DEMANDA LABORAL JDUCIAL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3352
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:856

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\20c8e6c1

          Filesize

          780KB

          MD5

          a76f91b03215d956f14f8b48871666cd

          SHA1

          bbf89df6448943cfee8ff26e6c00621db0bb71b4

          SHA256

          8d0ce850d1e69b71a8f6e118f58935d40fed66062ddcf78cbdd71a899e9f23fc

          SHA512

          babcbd0ba7a688b70e0f3a8ed325392324f7481fde3fe8d599a6fb7d3a30f6e82ac785cd1eff9a76de0de0bf47084e8dfdb51d5a4bacdeec278dd32251802c0f

        • memory/772-12-0x0000000000400000-0x0000000000711000-memory.dmp

          Filesize

          3.1MB

        • memory/772-1-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/772-2-0x00007FFE76AD0000-0x00007FFE76CC5000-memory.dmp

          Filesize

          2.0MB

        • memory/772-8-0x0000000074E73000-0x0000000074E75000-memory.dmp

          Filesize

          8KB

        • memory/772-9-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/772-10-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/772-13-0x000000004A600000-0x000000004A6EC000-memory.dmp

          Filesize

          944KB

        • memory/772-0-0x0000000000D30000-0x0000000000E3B000-memory.dmp

          Filesize

          1.0MB

        • memory/772-14-0x0000000000D30000-0x0000000000E3B000-memory.dmp

          Filesize

          1.0MB

        • memory/856-28-0x00000000753C0000-0x0000000075B70000-memory.dmp

          Filesize

          7.7MB

        • memory/856-30-0x0000000005490000-0x0000000005522000-memory.dmp

          Filesize

          584KB

        • memory/856-33-0x00000000753C0000-0x0000000075B70000-memory.dmp

          Filesize

          7.7MB

        • memory/856-32-0x00000000753CE000-0x00000000753CF000-memory.dmp

          Filesize

          4KB

        • memory/856-31-0x0000000005460000-0x000000000546A000-memory.dmp

          Filesize

          40KB

        • memory/856-23-0x0000000073930000-0x0000000074B84000-memory.dmp

          Filesize

          18.3MB

        • memory/856-26-0x00000000753CE000-0x00000000753CF000-memory.dmp

          Filesize

          4KB

        • memory/856-27-0x0000000000760000-0x0000000000776000-memory.dmp

          Filesize

          88KB

        • memory/856-29-0x0000000005860000-0x0000000005E04000-memory.dmp

          Filesize

          5.6MB

        • memory/3352-15-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/3352-17-0x00007FFE76AD0000-0x00007FFE76CC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3352-22-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/3352-20-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB

        • memory/3352-19-0x0000000074E60000-0x0000000074FDB000-memory.dmp

          Filesize

          1.5MB