Analysis

  • max time kernel
    209s
  • max time network
    182s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    31/10/2024, 05:21

General

  • Target

    there is no hope.exe

  • Size

    45KB

  • MD5

    f5512fda0f975a769cccbab2526f82b0

  • SHA1

    ef107ddb6a873d4e3b4f07573ec79ce8b37dc0f2

  • SHA256

    ff26fc14e5e32f4f2808d452b86909222a5d77b2ef03a7418527290d78cf90fc

  • SHA512

    75271798c172c1e8beac7169da97d5adebf926df88edb7c322699fbd53b58aaa78948a7e2fd9ce1de7c5703341a291c5a26c61254b75cba4dae16046b9db7bd5

  • SSDEEP

    768:Ku/dRTUo0HQbWUnmjSmo2qMUuzVrFZWPIxzjb2gX3iwM1A3Ce2XBDZ+x:Ku/dRTUPE231vx3bpXSwM+3Ud+x

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

mVH59AzvxdrQ

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\there is no hope.exe
    "C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5000
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4508
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4856
    • C:\Users\Admin\AppData\Local\Temp\there is no hope.exe
      "C:\Users\Admin\AppData\Local\Temp\there is no hope.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:972

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4508-14-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-16-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-12-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-13-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-15-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-5-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-7-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-17-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-11-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/4508-6-0x0000020E1A240000-0x0000020E1A241000-memory.dmp

            Filesize

            4KB

          • memory/5000-1-0x0000000000030000-0x0000000000042000-memory.dmp

            Filesize

            72KB

          • memory/5000-4-0x0000000075000000-0x00000000757B1000-memory.dmp

            Filesize

            7.7MB

          • memory/5000-0-0x000000007500E000-0x000000007500F000-memory.dmp

            Filesize

            4KB

          • memory/5000-3-0x000000007500E000-0x000000007500F000-memory.dmp

            Filesize

            4KB

          • memory/5000-2-0x0000000075000000-0x00000000757B1000-memory.dmp

            Filesize

            7.7MB

          • memory/5000-18-0x0000000075000000-0x00000000757B1000-memory.dmp

            Filesize

            7.7MB