Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 22:47
Behavioral task
behavioral1
Sample
msdtc.exe
Resource
win7-20240903-en
General
-
Target
msdtc.exe
-
Size
47KB
-
MD5
2731a98129622a67a970a173dda353ef
-
SHA1
4a705cfafbf7b1b543612203d09b16445a34887f
-
SHA256
804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
-
SHA512
0b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd
-
SSDEEP
768:8uX9m9T3YkeaWUMneAmo2qhtrKerR2L17BPIpvRIAe/o0b74e09w8Q1/znXTBDZl:8uX9m9T3Pg2ApXpvRO/Db7G9JQjdw+
Malware Config
Extracted
asyncrat
0.5.8
Default
87.120.113.125:6606
87.120.113.125:7707
87.120.113.125:8808
NnE2Recf2msF
-
delay
3
-
install
true
-
install_file
dwmm.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c8d-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation msdtc.exe -
Executes dropped EXE 1 IoCs
pid Process 1288 dwmm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3656 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3392 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe 2980 msdtc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2980 msdtc.exe Token: SeDebugPrivilege 1288 dwmm.exe Token: SeDebugPrivilege 1288 dwmm.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2980 wrote to memory of 4060 2980 msdtc.exe 86 PID 2980 wrote to memory of 4060 2980 msdtc.exe 86 PID 2980 wrote to memory of 4060 2980 msdtc.exe 86 PID 2980 wrote to memory of 1524 2980 msdtc.exe 88 PID 2980 wrote to memory of 1524 2980 msdtc.exe 88 PID 2980 wrote to memory of 1524 2980 msdtc.exe 88 PID 1524 wrote to memory of 3656 1524 cmd.exe 90 PID 1524 wrote to memory of 3656 1524 cmd.exe 90 PID 1524 wrote to memory of 3656 1524 cmd.exe 90 PID 4060 wrote to memory of 3392 4060 cmd.exe 91 PID 4060 wrote to memory of 3392 4060 cmd.exe 91 PID 4060 wrote to memory of 3392 4060 cmd.exe 91 PID 1524 wrote to memory of 1288 1524 cmd.exe 92 PID 1524 wrote to memory of 1288 1524 cmd.exe 92 PID 1524 wrote to memory of 1288 1524 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\msdtc.exe"C:\Users\Admin\AppData\Local\Temp\msdtc.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E24.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3656
-
-
C:\Users\Admin\AppData\Roaming\dwmm.exe"C:\Users\Admin\AppData\Roaming\dwmm.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD59ba17fe0e68297399c31a639bd7cd30f
SHA1b58c2b9bcddd59506ef898b52609a761ffb9e1da
SHA256974b768eceb8976dadc056b82d87c2f1287933a8d6fb179e092ff8dee1b6547b
SHA512a47edd0ab606c30086b5dfff1293ac23a3b9ea53ae7a51c3df46d848b26b715ec23b3aa2c05d3832edea1d932699df33488920606e2659e047d6090b2e9ba6ab
-
Filesize
47KB
MD52731a98129622a67a970a173dda353ef
SHA14a705cfafbf7b1b543612203d09b16445a34887f
SHA256804fb0f9b639fb03310d7cb96b74172d7dca3edcb1fc94b8caaa7cdad6d81e49
SHA5120b471cac88b99408f9c653bf4feb0947e944c466b55931881790b64fcd6606b42e2960687208f0a7ea3d10b1df3c18cc51fdf8f6f197acdc4df1f293b28cf0fd