Overview

overview

10

Static

static

10

WindowsDF.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 21:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WindowsDF.exe

  • Size

    74KB

  • MD5

    3cedbc72cc821f346b56100c311f7caf

  • SHA1

    09d762e1d9ec34854c50ab8c7063f7d44fd3165e

  • SHA256

    1583c039098be20a5d2076827affa434a8fd385f8e629ecdcdf44750d08dfbe2

  • SHA512

    04237742a94275fa68fb91b5a9d4dfd0f54174a6504bd726d63d53791dad2acc62356a74b8c0f2284fa93ad509468092c12fb1dc92c583d8197187b03b6301fa

  • SSDEEP

    1536:/Uq0cxVGlCBiPMVsOieqIbW1bh/k0owuQzcKLVclN:/UTcxVMWiPMVTHW1bhvCQ7BY

Score
10/10
asyncratdefaultdiscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

189.14.53.123:1177

189.14.53.123:21053
Mutex

cijkkekfusbnuncqp

Attributes
  • delay

    1

  • install

    true

  • install_file

    WindowsDefender.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Async RAT payload 1 IoCs
    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsDF.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsDF.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsDefender" /tr '"C:\Users\Admin\AppData\Roaming\WindowsDefender.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsDefender" /tr '"C:\Users\Admin\AppData\Roaming\WindowsDefender.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4268
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp99B0.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1408
      • C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
        "C:\Users\Admin\AppData\Roaming\WindowsDefender.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2028
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 189.14.53.123 4448 HVNC_MUTEX
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1584
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:2324
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 189.14.53.123 4448 HVNC_MUTEX
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5092
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
              PID:3556
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 189.14.53.123 4448 HVNC_MUTEX
              4⤵
                PID:1412
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 189.14.53.123 4448 HVNC_MUTEX
                4⤵
                  PID:1252
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 189.14.53.123 4448 HVNC_MUTEX
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4644
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:4596
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3900

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133777363620569104.txt
            Filesize

            75KB

            MD5

            c5a0947cbc1ee61ab68433022e14f53e

            SHA1

            f1a0c2540e542e45687a42b0970fb2280950414c

            SHA256

            51b63912436f2b1014b4612ed1a2ee71bc276ef6e02a7e5ba280cb72f05933c3

            SHA512

            8392853d633fd085cc7edad876233db0a2b80d6d78bcaae6712d0fc3ccbe45ab36487fcda622e3146f257f5ca10bb3cd5d51601748dd3d5bb03c5374b5cf7b6e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tmp99B0.tmp.bat
            Filesize

            159B

            MD5

            69619f69276f7ffa4aeb942d71808d45

            SHA1

            5aebfc1404db9ffb68c0f30d2f42822a6f4ab6d4

            SHA256

            e3478e809647f53fd5ea76e6c689e3361fab0679908825b9cb797211cd8bebe9

            SHA512

            f77c5ee2c0d201f80e33b70b7316b4c6375437331248e49ae91862e73943ae386ca9d2c1d74c9b3a1a2e2965fc878070c56d0a0479e52df52f90e6569e6b65f1

            Download Submit

          • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
            Filesize

            8B

            MD5

            cf759e4c5f14fe3eec41b87ed756cea8

            SHA1

            c27c796bb3c2fac929359563676f4ba1ffada1f5

            SHA256

            c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

            SHA512

            c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

            Download Submit

          • C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
            Filesize

            74KB

            MD5

            3cedbc72cc821f346b56100c311f7caf

            SHA1

            09d762e1d9ec34854c50ab8c7063f7d44fd3165e

            SHA256

            1583c039098be20a5d2076827affa434a8fd385f8e629ecdcdf44750d08dfbe2

            SHA512

            04237742a94275fa68fb91b5a9d4dfd0f54174a6504bd726d63d53791dad2acc62356a74b8c0f2284fa93ad509468092c12fb1dc92c583d8197187b03b6301fa

            Download Submit

          • memory/1584-24-0x0000000006470000-0x0000000006A14000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/1584-23-0x0000000005A70000-0x0000000005B0C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/1584-21-0x0000000000400000-0x0000000000410000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1584-22-0x0000000005930000-0x00000000059C2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/2028-26-0x00000000026F0000-0x00000000026F1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3456-8-0x00007FF9430B0000-0x00007FF943B71000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3456-3-0x00007FF9430B0000-0x00007FF943B71000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3456-1-0x0000000000A50000-0x0000000000A68000-memory.dmp

            Filesize

            96KB

            Download

          • memory/3456-9-0x00007FF9430B0000-0x00007FF943B71000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3456-0-0x00007FF9430B3000-0x00007FF9430B5000-memory.dmp

            Filesize

            8KB

            Download

          • memory/3900-28-0x00000167D1100000-0x00000167D1200000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/3900-29-0x00000167D1100000-0x00000167D1200000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/3900-33-0x00000167D2120000-0x00000167D2140000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3900-64-0x00000167D24F0000-0x00000167D2510000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3900-63-0x00000167D1DE0000-0x00000167D1E00000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4548-20-0x000000001B5A0000-0x000000001B5C0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4548-19-0x000000001B450000-0x000000001B46E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4548-18-0x0000000002880000-0x0000000002890000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4548-17-0x000000001B840000-0x000000001B8B6000-memory.dmp

            Filesize

            472KB

            Download