Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 03:01 UTC

General

  • Target

    Drawing&spec.scr

  • Size

    941KB

  • MD5

    3a43f4d6c1ce25bc8efe548fa2b16bc7

  • SHA1

    e0b8080d2c241ee9c8d7d31adb6ecc0fc43d0a0e

  • SHA256

    4b5cc1e99d28651fbb693422c5d392c5d47dfa61c8ec4995197706de5cb3442a

  • SHA512

    3613b2af89545273fb21c09889e02e477d86ac2e3f313fec2a28fb68c9e94b39b3160b26d7637dce1e5053808ffe14cb0aad9dd0c404bbd6d4c8d7ea897e8072

  • SSDEEP

    24576:uu6J33O0c+JY5UZ+XC0kGso6FauSnJzxWY:gu0c++OCvkGs9FauSaY

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

69.174.100.131:6606

Mutex

abkZfsCYRZhk

Attributes
  • delay

    10

  • install

    false

  • install_file

    order.exe

  • install_folder

    %AppData%

aes.plain
1
kxQvmCDWumEsZkspIkYIxthHZPBxAooz

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Drawing&spec.scr
    "C:\Users\Admin\AppData\Local\Temp\Drawing&spec.scr" /S
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\iodite\unfatigued.exe
      "C:\Users\Admin\AppData\Local\Temp\Drawing&spec.scr" /S
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\Drawing&spec.scr" /S
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1388

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    131.100.174.69.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    131.100.174.69.in-addr.arpa
    IN PTR
    Response
    131.100.174.69.in-addr.arpa
    IN PTR
    unassigned quadranetcom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 69.174.100.131:6606
    tls
    RegSvcs.exe
    7.4kB
    6.6kB
    68
    73
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    131.100.174.69.in-addr.arpa
    dns
    73 B
    111 B
    1
    1

    DNS Request

    131.100.174.69.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
    131 B
    1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\intersentimental

    Filesize

    45KB

    MD5

    064c06ce3704ac5ce2d8efeb296a9422

    SHA1

    dcc706429d796903bcd7e77d41e5981beff878f4

    SHA256

    819cc43386c4eb72d4ae4e4edcf9eb5f0a654dfe3b56b45c5f9a9d553bc9cc82

    SHA512

    423fda98347db0f083a74c758b8526119a87e0944a067503d380c504e3ad9a341c122f721f86bb75bb9aa2f1017d4bad6c298bcbcc98e8fb1dcef722919205de

  • C:\Users\Admin\AppData\Local\iodite\unfatigued.exe

    Filesize

    941KB

    MD5

    3a43f4d6c1ce25bc8efe548fa2b16bc7

    SHA1

    e0b8080d2c241ee9c8d7d31adb6ecc0fc43d0a0e

    SHA256

    4b5cc1e99d28651fbb693422c5d392c5d47dfa61c8ec4995197706de5cb3442a

    SHA512

    3613b2af89545273fb21c09889e02e477d86ac2e3f313fec2a28fb68c9e94b39b3160b26d7637dce1e5053808ffe14cb0aad9dd0c404bbd6d4c8d7ea897e8072

  • memory/1388-20-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1388-21-0x000000007531E000-0x000000007531F000-memory.dmp

    Filesize

    4KB

  • memory/1388-22-0x000000007531E000-0x000000007531F000-memory.dmp

    Filesize

    4KB

  • memory/1388-23-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1388-26-0x0000000005F00000-0x0000000005F9C000-memory.dmp

    Filesize

    624KB

  • memory/1388-27-0x0000000006550000-0x0000000006AF4000-memory.dmp

    Filesize

    5.6MB

  • memory/1388-28-0x00000000059F0000-0x0000000005A56000-memory.dmp

    Filesize

    408KB

  • memory/1388-29-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4824-6-0x00000000014E0000-0x00000000018E0000-memory.dmp

    Filesize

    4.0MB

  • memory/4860-18-0x0000000001480000-0x0000000001880000-memory.dmp

    Filesize

    4.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.