Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 05:33
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
General
-
Target
Client.exe
-
Size
48KB
-
MD5
3b4c1a3663d6d5ae561b793822b045ab
-
SHA1
2ef8222de19762ab8558922b3ba3cfe53285b7ae
-
SHA256
56ab78b1f5f73c93d063d4c85837353b96c19bdacecb1d4ed955d170d2553980
-
SHA512
034bdc45bed22d7ad968ce7b6747ba2dfb80d350a82f77d291e01bb0076fb69e7fa79ff4f4b8160ae6779d466123fe50278c7c8ee3d04ce0c3ff9b2202e27b16
-
SSDEEP
768:1UcRUbDILQe08+bixtelDSN+iV08YbygextUBl/of1vEgK/JbWfVc6KN:mc8ExtKDs4zb10yBJK1nkJbWfVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
opus hook injector.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x0002000000022b13-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Client.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Client.exe -
Executes dropped EXE 1 IoCs
Processes:
opus hook injector.exepid Process 2208 opus hook injector.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 1700 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Client.exeopus hook injector.exepid Process 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 1320 Client.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe 2208 opus hook injector.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client.exeopus hook injector.exedescription pid Process Token: SeDebugPrivilege 1320 Client.exe Token: SeDebugPrivilege 2208 opus hook injector.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Client.execmd.execmd.exedescription pid Process procid_target PID 1320 wrote to memory of 4512 1320 Client.exe 87 PID 1320 wrote to memory of 4512 1320 Client.exe 87 PID 1320 wrote to memory of 4716 1320 Client.exe 89 PID 1320 wrote to memory of 4716 1320 Client.exe 89 PID 4716 wrote to memory of 1700 4716 cmd.exe 91 PID 4716 wrote to memory of 1700 4716 cmd.exe 91 PID 4512 wrote to memory of 4144 4512 cmd.exe 92 PID 4512 wrote to memory of 4144 4512 cmd.exe 92 PID 4716 wrote to memory of 2208 4716 cmd.exe 100 PID 4716 wrote to memory of 2208 4716 cmd.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "opus hook injector" /tr '"C:\Users\Admin\AppData\Roaming\opus hook injector.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "opus hook injector" /tr '"C:\Users\Admin\AppData\Roaming\opus hook injector.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A1F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1700
-
-
C:\Users\Admin\AppData\Roaming\opus hook injector.exe"C:\Users\Admin\AppData\Roaming\opus hook injector.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD52d89521f6956aed9f64bbb5f9b5b936d
SHA129ea7f250ec5edd123570a9d13df3c96075869ab
SHA256df7c9e59f28a4c64efe5f8e021b22cf517cd9bc222d84bd2268b2aea5561b200
SHA512be08836d925f2e22841fafaab4bc59549d5dc4a2623bfaca6dbcb0e600955b97845e65df6b9e2782563be296c2bf746fce5429d549f1a3506de18a722aab891b
-
Filesize
48KB
MD53b4c1a3663d6d5ae561b793822b045ab
SHA12ef8222de19762ab8558922b3ba3cfe53285b7ae
SHA25656ab78b1f5f73c93d063d4c85837353b96c19bdacecb1d4ed955d170d2553980
SHA512034bdc45bed22d7ad968ce7b6747ba2dfb80d350a82f77d291e01bb0076fb69e7fa79ff4f4b8160ae6779d466123fe50278c7c8ee3d04ce0c3ff9b2202e27b16