Analysis
-
max time kernel
109s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 22:44
Behavioral task
behavioral1
Sample
msdtc.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
150 seconds
General
-
Target
msdtc.exe
-
Size
47KB
-
MD5
2731a98129622a67a970a173dda353ef
-
SHA1
4a705cfafbf7b1b543612203d09b16445a34887f
-
SHA256
804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
-
SHA512
0b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd
-
SSDEEP
768:8uX9m9T3YkeaWUMneAmo2qhtrKerR2L17BPIpvRIAe/o0b74e09w8Q1/znXTBDZl:8uX9m9T3Pg2ApXpvRO/Db7G9JQjdw+
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
87.120.113.125:6606
87.120.113.125:7707
87.120.113.125:8808
Mutex
NnE2Recf2msF
Attributes
-
delay
3
-
install
true
-
install_file
dwmm.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000700000001e104-23.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation msdtc.exe -
Executes dropped EXE 1 IoCs
pid Process 4440 dwmm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3576 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3472 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 2344 msdtc.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4924 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4924 taskmgr.exe Token: SeSystemProfilePrivilege 4924 taskmgr.exe Token: SeCreateGlobalPrivilege 4924 taskmgr.exe Token: SeDebugPrivilege 2344 msdtc.exe Token: SeDebugPrivilege 4440 dwmm.exe Token: SeDebugPrivilege 4440 dwmm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2184 2344 msdtc.exe 87 PID 2344 wrote to memory of 2184 2344 msdtc.exe 87 PID 2344 wrote to memory of 2184 2344 msdtc.exe 87 PID 2344 wrote to memory of 436 2344 msdtc.exe 89 PID 2344 wrote to memory of 436 2344 msdtc.exe 89 PID 2344 wrote to memory of 436 2344 msdtc.exe 89 PID 436 wrote to memory of 3576 436 cmd.exe 91 PID 436 wrote to memory of 3576 436 cmd.exe 91 PID 436 wrote to memory of 3576 436 cmd.exe 91 PID 2184 wrote to memory of 3472 2184 cmd.exe 92 PID 2184 wrote to memory of 3472 2184 cmd.exe 92 PID 2184 wrote to memory of 3472 2184 cmd.exe 92 PID 436 wrote to memory of 4440 436 cmd.exe 94 PID 436 wrote to memory of 4440 436 cmd.exe 94 PID 436 wrote to memory of 4440 436 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\msdtc.exe"C:\Users\Admin\AppData\Local\Temp\msdtc.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7C92.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3576
-
-
C:\Users\Admin\AppData\Roaming\dwmm.exe"C:\Users\Admin\AppData\Roaming\dwmm.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD509751584633868b49d075e7bb79fa24c
SHA1a5919907f46f651a39976a2881f47c62389e023a
SHA256933f8a1edcc1302fd61daa6040ebe4bfca35ac8baa753391fd35c8494b2802a2
SHA51268e888606b5c8be63fe9e538a90c4b21fc71d85de66d23507878078176b6e2a61c2ffde2febd4a1f6bc6bd22217f1844092f32009cb29ff497ce1406f8e4cfa9
-
Filesize
47KB
MD52731a98129622a67a970a173dda353ef
SHA14a705cfafbf7b1b543612203d09b16445a34887f
SHA256804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
SHA5120b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd