Analysis
-
max time kernel
164s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 14:58
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win10v2004-20241007-en
General
-
Target
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
-
Size
2.2MB
-
MD5
d9530ecee42acccfd3871672a511bc9e
-
SHA1
89b4d2406f1294bd699ef231a4def5f495f12778
-
SHA256
81e04f9a131534acc0e9de08718c062d3d74c80c7f168ec7e699cd4b2bd0f280
-
SHA512
d5f048ea995affdf9893ec4c5ac5eb188b6714f5b6712e0b5a316702033421b145b8ee6a62d303eb4576bf8f57273ff35c5d675807563a31157136f79d8a9980
-
SSDEEP
49152:rHOut2Bf0ajIM8XEEN6N0rE/I/vqn7krQEQusd5F:VbaMbXbE/I/SnwrQEQusd/
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
30 WINS
3010wins.duckdns.org:9003
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
00030 NotificacionElectronica.execmd.exedescription pid process target process PID 5068 set thread context of 5024 5068 00030 NotificacionElectronica.exe cmd.exe PID 5024 set thread context of 648 5024 cmd.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MSBuild.exe00030 NotificacionElectronica.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00030 NotificacionElectronica.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
00030 NotificacionElectronica.execmd.exepid process 5068 00030 NotificacionElectronica.exe 5068 00030 NotificacionElectronica.exe 5024 cmd.exe 5024 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
00030 NotificacionElectronica.execmd.exepid process 5068 00030 NotificacionElectronica.exe 5024 cmd.exe 5024 cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
00030 NotificacionElectronica.execmd.exedescription pid process target process PID 5068 wrote to memory of 5024 5068 00030 NotificacionElectronica.exe cmd.exe PID 5068 wrote to memory of 5024 5068 00030 NotificacionElectronica.exe cmd.exe PID 5068 wrote to memory of 5024 5068 00030 NotificacionElectronica.exe cmd.exe PID 5068 wrote to memory of 5024 5068 00030 NotificacionElectronica.exe cmd.exe PID 5024 wrote to memory of 648 5024 cmd.exe MSBuild.exe PID 5024 wrote to memory of 648 5024 cmd.exe MSBuild.exe PID 5024 wrote to memory of 648 5024 cmd.exe MSBuild.exe PID 5024 wrote to memory of 648 5024 cmd.exe MSBuild.exe PID 5024 wrote to memory of 648 5024 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\00030 NotificacionElectronica.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\00030 NotificacionElectronica.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777KB
MD51750e5fcdad4f5335b2030d223d0598a
SHA1a058df51872af153e70c0ccef4d847050c27ceac
SHA256694327e4cc925f3fa9cc4ce6c3078c14f7fc4ed26bae1c2d94e7ee007a1f2338
SHA512a206d8cbd4d3e490566a3bc7ad07598ca83c121ce4203a5984e83d3cc7547aa2e947c322240e27ba90734d1845147d33874211ff5dc269e8936e2c28e7986b29