Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 22:44
Behavioral task
behavioral1
Sample
msdtc.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
150 seconds
General
-
Target
msdtc.exe
-
Size
47KB
-
MD5
2731a98129622a67a970a173dda353ef
-
SHA1
4a705cfafbf7b1b543612203d09b16445a34887f
-
SHA256
804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
-
SHA512
0b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd
-
SSDEEP
768:8uX9m9T3YkeaWUMneAmo2qhtrKerR2L17BPIpvRIAe/o0b74e09w8Q1/znXTBDZl:8uX9m9T3Pg2ApXpvRO/Db7G9JQjdw+
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
87.120.113.125:6606
87.120.113.125:7707
87.120.113.125:8808
Mutex
NnE2Recf2msF
Attributes
-
delay
3
-
install
true
-
install_file
dwmm.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000a00000001202c-14.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2840 dwmm.exe -
Loads dropped DLL 1 IoCs
pid Process 2920 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwmm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2448 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1288 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 msdtc.exe 2372 msdtc.exe 2372 msdtc.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2372 msdtc.exe Token: SeDebugPrivilege 2840 dwmm.exe Token: SeDebugPrivilege 2840 dwmm.exe Token: SeDebugPrivilege 2672 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2364 2372 msdtc.exe 31 PID 2372 wrote to memory of 2364 2372 msdtc.exe 31 PID 2372 wrote to memory of 2364 2372 msdtc.exe 31 PID 2372 wrote to memory of 2364 2372 msdtc.exe 31 PID 2372 wrote to memory of 2920 2372 msdtc.exe 33 PID 2372 wrote to memory of 2920 2372 msdtc.exe 33 PID 2372 wrote to memory of 2920 2372 msdtc.exe 33 PID 2372 wrote to memory of 2920 2372 msdtc.exe 33 PID 2364 wrote to memory of 1288 2364 cmd.exe 35 PID 2364 wrote to memory of 1288 2364 cmd.exe 35 PID 2364 wrote to memory of 1288 2364 cmd.exe 35 PID 2364 wrote to memory of 1288 2364 cmd.exe 35 PID 2920 wrote to memory of 2448 2920 cmd.exe 36 PID 2920 wrote to memory of 2448 2920 cmd.exe 36 PID 2920 wrote to memory of 2448 2920 cmd.exe 36 PID 2920 wrote to memory of 2448 2920 cmd.exe 36 PID 2920 wrote to memory of 2840 2920 cmd.exe 37 PID 2920 wrote to memory of 2840 2920 cmd.exe 37 PID 2920 wrote to memory of 2840 2920 cmd.exe 37 PID 2920 wrote to memory of 2840 2920 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\msdtc.exe"C:\Users\Admin\AppData\Local\Temp\msdtc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1288
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B55.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2448
-
-
C:\Users\Admin\AppData\Roaming\dwmm.exe"C:\Users\Admin\AppData\Roaming\dwmm.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5d4aeaaac1e04b57ede31ca5045d5f47c
SHA1ea0d9e22af95ad6851dc11dc63826c32ce7e9330
SHA2565a544004132a5ad67cddb0e3b0ae2e30cc5c9dc5b89f838853de2aec64295e59
SHA512bd67a740d9e92c782ca9a1585385277fafbdd1ad728cac4297c15c6b5edbcda4d1f3062df139e655ae724eb1ec8c0734bed79b20cb0e98dc06a14c58903b1a31
-
Filesize
47KB
MD52731a98129622a67a970a173dda353ef
SHA14a705cfafbf7b1b543612203d09b16445a34887f
SHA256804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
SHA5120b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd