Analysis
-
max time kernel
170s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 15:00
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win10v2004-20241007-en
General
-
Target
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
-
Size
2.2MB
-
MD5
d9530ecee42acccfd3871672a511bc9e
-
SHA1
89b4d2406f1294bd699ef231a4def5f495f12778
-
SHA256
81e04f9a131534acc0e9de08718c062d3d74c80c7f168ec7e699cd4b2bd0f280
-
SHA512
d5f048ea995affdf9893ec4c5ac5eb188b6714f5b6712e0b5a316702033421b145b8ee6a62d303eb4576bf8f57273ff35c5d675807563a31157136f79d8a9980
-
SSDEEP
49152:rHOut2Bf0ajIM8XEEN6N0rE/I/vqn7krQEQusd5F:VbaMbXbE/I/SnwrQEQusd/
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
30 WINS
3010wins.duckdns.org:9003
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
00030 NotificacionElectronica.execmd.exedescription pid process target process PID 2932 set thread context of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2816 set thread context of 2188 2816 cmd.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
00030 NotificacionElectronica.execmd.exeMSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00030 NotificacionElectronica.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
00030 NotificacionElectronica.execmd.exepid process 2932 00030 NotificacionElectronica.exe 2932 00030 NotificacionElectronica.exe 2816 cmd.exe 2816 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
00030 NotificacionElectronica.execmd.exepid process 2932 00030 NotificacionElectronica.exe 2816 cmd.exe 2816 cmd.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
00030 NotificacionElectronica.execmd.exedescription pid process target process PID 2932 wrote to memory of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2932 wrote to memory of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2932 wrote to memory of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2932 wrote to memory of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2932 wrote to memory of 2816 2932 00030 NotificacionElectronica.exe cmd.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe PID 2816 wrote to memory of 2188 2816 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\00030 NotificacionElectronica.exe"C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\00030 NotificacionElectronica.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777KB
MD5df67ce4da105c9e4ff53092373ab678c
SHA13e39c325c892f928f58efdda2bfd594f74e7411b
SHA256485727e7e14d3e809172c5f5913c45d658eb77a5a2f94089feda3affbcd454d3
SHA512f281747cfe92576389cfe547ec7a15988a6ae136d22e1e7326ebac54d96322e32ab71ef00ca11cdecd3ddfd1aa5028a6632c23cea65b835afdec2fa986c0a440