Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 18:30
Behavioral task
behavioral1
Sample
2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe
Resource
win7-20240903-en
General
-
Target
2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe
-
Size
45KB
-
MD5
94eb371cf65dc29a53fcf3bc0173b35e
-
SHA1
ad4ddf8884c805f86ec09063cf6653ec012ae941
-
SHA256
2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201
-
SHA512
c6fba4eea2e88dd34390ac8b9a38578e0b83731fb6ef8a551fa4d1489cbc64bb3eab6c9dc7c3a7872c9e595b8d016898f25a5f3e1e3bc1ceca8019816f5f6248
-
SSDEEP
768:8u6cdTAYhbJWUh9Nzmo2qLfKjPGagAWOzjbFgX3i6BwXytKe+CANqlcDZ2j+:8u6cdTAur2yKTKTO3bCXS6Bw+z+7Fd2S
Malware Config
Extracted
asyncrat
0.5.7B
Default
45.147.46.188:1604
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
abd.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000e000000023b58-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe -
Executes dropped EXE 1 IoCs
pid Process 1580 abd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4424 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe Token: SeDebugPrivilege 1580 abd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3552 wrote to memory of 2276 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 91 PID 3552 wrote to memory of 2276 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 91 PID 3552 wrote to memory of 2276 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 91 PID 3552 wrote to memory of 752 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 93 PID 3552 wrote to memory of 752 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 93 PID 3552 wrote to memory of 752 3552 2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe 93 PID 2276 wrote to memory of 2056 2276 cmd.exe 95 PID 2276 wrote to memory of 2056 2276 cmd.exe 95 PID 2276 wrote to memory of 2056 2276 cmd.exe 95 PID 752 wrote to memory of 4424 752 cmd.exe 96 PID 752 wrote to memory of 4424 752 cmd.exe 96 PID 752 wrote to memory of 4424 752 cmd.exe 96 PID 752 wrote to memory of 1580 752 cmd.exe 98 PID 752 wrote to memory of 1580 752 cmd.exe 98 PID 752 wrote to memory of 1580 752 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe"C:\Users\Admin\AppData\Local\Temp\2a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "abd" /tr '"C:\Users\Admin\AppData\Roaming\abd.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "abd" /tr '"C:\Users\Admin\AppData\Roaming\abd.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC719.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4424
-
-
C:\Users\Admin\AppData\Roaming\abd.exe"C:\Users\Admin\AppData\Roaming\abd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD5879c9e8477a5d75f1b32d78ec87f5f51
SHA193b441379126b9deb4d25ac2b455c0dcb78f6f24
SHA256396dc6ca7721849c4617de6a26f77acd9028266bc115ecdd9b0c18cc83d332b1
SHA512c2d71ece5cceb33f059b6e4ecea55952d18942248bf24a582bb85b4c862ff0d33ae0404e99a34ea0e176aaf963807656864e328272fbf61432cc53f14d48a850
-
Filesize
45KB
MD594eb371cf65dc29a53fcf3bc0173b35e
SHA1ad4ddf8884c805f86ec09063cf6653ec012ae941
SHA2562a465e1cff39d36c45dc0f9b28440411187ebe843e9311e2820804942d72e201
SHA512c6fba4eea2e88dd34390ac8b9a38578e0b83731fb6ef8a551fa4d1489cbc64bb3eab6c9dc7c3a7872c9e595b8d016898f25a5f3e1e3bc1ceca8019816f5f6248