Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03/11/2024, 18:55
General
-
Target
Async test.exe
-
Size
45KB
-
MD5
86fef5dcbb9a2ea221b850234dcc9e83
-
SHA1
c004d33bc9ee3beaa3d90a28034e642b7706e5f4
-
SHA256
27c32cc7628ee560b44cb55dd9a85508d919a28726cf817ec9fad2730c2c7c6b
-
SHA512
d7da030148b4adb6a2be3d3e9cbc60ad58a2e3104b68c89ebfb6392194bf60bc37fd76c26036ce3a4167adc1291c770d5f211b08c36c1b3a1d3b1704a1a4c32d
-
SSDEEP
768:mu/dRTUo0HQbWUnmjSmo2qMTCZf31PIdzjbkgX3ixYkOQ/1z1DL5R/KEquBDZyx:mu/dRTUPE2XIPSd3brXSxKyz1vXZqgdw
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
E2qgtjRHaRSi
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Async test.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2956 taskmgr.exe Token: SeSystemProfilePrivilege 2956 taskmgr.exe Token: SeCreateGlobalPrivilege 2956 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Async test.exe"C:\Users\Admin\AppData\Local\Temp\Async test.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3540
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2956