Analysis
-
max time kernel
209s -
max time network
182s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
31/10/2024, 05:21
General
-
Target
there is no hope.exe
-
Size
45KB
-
MD5
f5512fda0f975a769cccbab2526f82b0
-
SHA1
ef107ddb6a873d4e3b4f07573ec79ce8b37dc0f2
-
SHA256
ff26fc14e5e32f4f2808d452b86909222a5d77b2ef03a7418527290d78cf90fc
-
SHA512
75271798c172c1e8beac7169da97d5adebf926df88edb7c322699fbd53b58aaa78948a7e2fd9ce1de7c5703341a291c5a26c61254b75cba4dae16046b9db7bd5
-
SSDEEP
768:Ku/dRTUo0HQbWUnmjSmo2qMUuzVrFZWPIxzjb2gX3iwM1A3Ce2XBDZ+x:Ku/dRTUPE231vx3bpXSwM+3Ud+x
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
mVH59AzvxdrQ
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language there is no hope.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language there is no hope.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4508 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4508 taskmgr.exe Token: SeSystemProfilePrivilege 4508 taskmgr.exe Token: SeCreateGlobalPrivilege 4508 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5000
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4508
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"1⤵
- System Location Discovery: System Language Discovery
PID:972