Analysis

  • max time kernel
    150s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 15:12

General

  • Target

    VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe

  • Size

    1.2MB

  • MD5

    03f0ee8b8dea367a9103c169d10c583c

  • SHA1

    2015ad059d6726a328f073bf6b77f1dd8f0df1f0

  • SHA256

    5b8aa9408ee3d18a803df688974bfc125b110db19349e1938ac8d3bb6a966fcc

  • SHA512

    87f6d5386ab9f81894556f9315a0124b9db1366a21b85c418af727235a7c0f93f91f17cc3753425979e2b24b4958b33f62620b7ab803df6b60e811f6b61f2d6e

  • SSDEEP

    24576:6mGcXFh4xuKn47ipX4fai8Wh1vW1kuT4SKd0:66XFCxf80ofas1v8T450

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe
        "C:\Users\Admin\AppData\Local\Temp\VER PROCESO ADELANTADO EN SU CONTRA RD20017-70-71216-2024-00926-00.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3372
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1028-1094-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1028-1095-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1028-1097-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1028-1098-0x0000000002B00000-0x0000000002B0A000-memory.dmp

      Filesize

      40KB

    • memory/1028-1099-0x00000000055B0000-0x000000000564C000-memory.dmp

      Filesize

      624KB

    • memory/1028-1102-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1028-1101-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1028-1100-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

    • memory/3372-35-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-25-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-5-0x0000000005550000-0x00000000055E2000-memory.dmp

      Filesize

      584KB

    • memory/3372-29-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-27-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-61-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-69-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-67-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-65-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-63-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-57-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-55-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-53-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-51-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-49-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-47-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-46-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-41-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-39-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-37-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-3-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3372-33-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-31-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-4-0x0000000005A60000-0x0000000006004000-memory.dmp

      Filesize

      5.6MB

    • memory/3372-23-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-9-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-59-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-43-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-6-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-21-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-19-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-17-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-15-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-13-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-11-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-7-0x00000000053C0000-0x00000000054A7000-memory.dmp

      Filesize

      924KB

    • memory/3372-1080-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3372-1081-0x0000000005650000-0x00000000056AE000-memory.dmp

      Filesize

      376KB

    • memory/3372-1082-0x00000000055F0000-0x000000000563C000-memory.dmp

      Filesize

      304KB

    • memory/3372-1087-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3372-1086-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3372-1088-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3372-2-0x00000000053C0000-0x00000000054AC000-memory.dmp

      Filesize

      944KB

    • memory/3372-1-0x0000000000740000-0x0000000000878000-memory.dmp

      Filesize

      1.2MB

    • memory/3372-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

      Filesize

      4KB

    • memory/3372-1089-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

      Filesize

      4KB

    • memory/3372-1090-0x0000000000950000-0x00000000009A4000-memory.dmp

      Filesize

      336KB

    • memory/3372-1096-0x0000000074F00000-0x00000000756B0000-memory.dmp

      Filesize

      7.7MB