Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03-12-2024 20:40
General
-
Target
Client.exe
-
Size
71KB
-
MD5
b4bac2deae2b84bd744b65aa06d4d649
-
SHA1
1f932fa916c39288bc00763f70a78d393f63fe24
-
SHA256
90530f98b7e3fd31895b43d5bc1df0de4226f9b7c327ab4ec6c2c2a697bc6775
-
SHA512
0dd9154a02a0035eb8b0706c92ae50de25f314ddc2cecddeb40d2556394debf31b27fe01a531723ca311bd75d53ecb033faab4c8389fef275b26adc4ea4ee6e1
-
SSDEEP
768:BHAUR8bIL+Cyq+DiZtelDSN+iV08Ybyge5zcu0KomvEgK/J/pp6uBJjZ4Vc6KN:dPIeZtKDs4zb1VuQmnkJ/pp6EOVclN
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
193.161.193.99:22
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4080 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4080 taskmgr.exe Token: SeSystemProfilePrivilege 4080 taskmgr.exe Token: SeCreateGlobalPrivilege 4080 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe 4080 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵PID:4768
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4080