Overview
overview
10Static
static
1015a83de318...fa.exe
windows7-x64
615a83de318...fa.exe
windows10-2004-x64
6304f9bc7de...1b.exe
windows7-x64
10304f9bc7de...1b.exe
windows10-2004-x64
1043087ea949...eb.exe
windows7-x64
1043087ea949...eb.exe
windows10-2004-x64
1061bb2c746d...fd.exe
windows7-x64
1061bb2c746d...fd.exe
windows10-2004-x64
1078ae7a93d9...b6.exe
windows7-x64
1078ae7a93d9...b6.exe
windows10-2004-x64
10878487e25e...53.exe
windows7-x64
10878487e25e...53.exe
windows10-2004-x64
10922135a10e...54.exe
windows7-x64
10922135a10e...54.exe
windows10-2004-x64
1098e12d1098...ad.exe
windows7-x64
1098e12d1098...ad.exe
windows10-2004-x64
10b67bc3d957...8f.exe
windows7-x64
8b67bc3d957...8f.exe
windows10-2004-x64
8Analysis
-
max time kernel
67s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 16:29
Behavioral task
behavioral1
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral4
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
-
Size
45KB
-
MD5
5af5a9087ecf42eb83fb358d49b06e92
-
SHA1
0d4a5c5d90e6306c476036ca097a01a17b4295db
-
SHA256
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453
-
SHA512
d0608f648dd26b81d262741c373737dba3bfeb1508f86d8c448ec634a78bd9f86f52961d22cf027418c5012f2f7388928480495003dfeac7b94deb590bb7d22c
-
SSDEEP
768:Qu08dTbAoeyWUE++Ymo2q8EpL2d78tPIAzjbygX3i46U44rylUVkBDZax:Qu08dTbfz2ESA3b1XSHULy9dax
Malware Config
Extracted
asyncrat
0.5.7B
Default
206.123.141.239:7777
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
12376w8q09dq.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral11/files/0x0003000000012000-13.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2612 12376w8q09dq.exe -
Loads dropped DLL 1 IoCs
pid Process 2572 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12376w8q09dq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1312 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2664 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe Token: SeDebugPrivilege 2612 12376w8q09dq.exe Token: SeDebugPrivilege 2612 12376w8q09dq.exe Token: SeDebugPrivilege 2588 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe 2588 taskmgr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2556 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 31 PID 2212 wrote to memory of 2556 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 31 PID 2212 wrote to memory of 2556 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 31 PID 2212 wrote to memory of 2556 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 31 PID 2212 wrote to memory of 2572 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 33 PID 2212 wrote to memory of 2572 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 33 PID 2212 wrote to memory of 2572 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 33 PID 2212 wrote to memory of 2572 2212 878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe 33 PID 2556 wrote to memory of 2664 2556 cmd.exe 35 PID 2556 wrote to memory of 2664 2556 cmd.exe 35 PID 2556 wrote to memory of 2664 2556 cmd.exe 35 PID 2556 wrote to memory of 2664 2556 cmd.exe 35 PID 2572 wrote to memory of 1312 2572 cmd.exe 36 PID 2572 wrote to memory of 1312 2572 cmd.exe 36 PID 2572 wrote to memory of 1312 2572 cmd.exe 36 PID 2572 wrote to memory of 1312 2572 cmd.exe 36 PID 2572 wrote to memory of 2612 2572 cmd.exe 37 PID 2572 wrote to memory of 2612 2572 cmd.exe 37 PID 2572 wrote to memory of 2612 2572 cmd.exe 37 PID 2572 wrote to memory of 2612 2572 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"C:\Users\Admin\AppData\Local\Temp\878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "12376w8q09dq" /tr '"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2664
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp915.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1312
-
-
C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"C:\Users\Admin\AppData\Roaming\12376w8q09dq.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD5b3fc987efb54ee1b3ab0d38d9a4cc4de
SHA1f725285f5085f8267deb45b2b440ec338bc4e4ae
SHA256a3c7093d05353e21a622658da54190867a0f9e1def4e1bfc4b97adde28752953
SHA512e13af8cf55ba2a3319498a2a1a4e418f4fa845edd1ad6b3bb4f80673737b406f0099c709824a81217d438b27efa14bdab8acb3d5a98febb89d414dfe2b6fa00a
-
Filesize
45KB
MD55af5a9087ecf42eb83fb358d49b06e92
SHA10d4a5c5d90e6306c476036ca097a01a17b4295db
SHA256878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453
SHA512d0608f648dd26b81d262741c373737dba3bfeb1508f86d8c448ec634a78bd9f86f52961d22cf027418c5012f2f7388928480495003dfeac7b94deb590bb7d22c