Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/12/2024, 02:57
General
-
Target
roaricle.exe
-
Size
63KB
-
MD5
9f39043be09533636bbfdd4ec3101f6a
-
SHA1
1e964ba2a874c24a5fdc430c827a1ba82dc657ab
-
SHA256
179027517e90f9e8173f63ba247d7c0d414259fdef3a29a5692c85d84dce557d
-
SHA512
09c0573e2f4db331714d86d32abf9623b5a9560c1e7ac8359a0ef434cc79940143e837a2674aa5140b79e1b1302faf75df9959d184109aad231db78a90139233
-
SSDEEP
1536:PJxFz3FI8Cwof4wJ6Vfh2MBPG2bPw0mQCfhGxZVclN:PJxFz3FI8Cwo7J6VJL1G2bPTCfwzY
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
fojeweb571-45302.portmap.host:4782
fojeweb571-45302.portmap.host:45302
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x001d00000002ab0d-11.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1308 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2156 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4780 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4928 roaricle.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4316 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4928 roaricle.exe Token: SeDebugPrivilege 1308 windows defender firewall.exe Token: SeDebugPrivilege 4316 taskmgr.exe Token: SeSystemProfilePrivilege 4316 taskmgr.exe Token: SeCreateGlobalPrivilege 4316 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4144 4928 roaricle.exe 77 PID 4928 wrote to memory of 4144 4928 roaricle.exe 77 PID 4928 wrote to memory of 1556 4928 roaricle.exe 79 PID 4928 wrote to memory of 1556 4928 roaricle.exe 79 PID 1556 wrote to memory of 2156 1556 cmd.exe 81 PID 1556 wrote to memory of 2156 1556 cmd.exe 81 PID 4144 wrote to memory of 4780 4144 cmd.exe 82 PID 4144 wrote to memory of 4780 4144 cmd.exe 82 PID 1556 wrote to memory of 1308 1556 cmd.exe 83 PID 1556 wrote to memory of 1308 1556 cmd.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\roaricle.exe"C:\Users\Admin\AppData\Local\Temp\roaricle.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9A4C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2156
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD56bc04923e4ce4b7b7e526912d6e8d22d
SHA1ca029687163e48328eb445395147c627fca47dbc
SHA2563f26c1f42c2580744a080a1add4ce567948ad4b7c430271c3d2dfdb558d24545
SHA5124f272ef9a01da904ea817758c3cd2b9eb1bec9adbcafab933654cb6585aefdc4e4fe2ac639a8b5ec0f686d8af9c7d262bf297089aed39e74ef5f1616f9649183
-
Filesize
63KB
MD59f39043be09533636bbfdd4ec3101f6a
SHA11e964ba2a874c24a5fdc430c827a1ba82dc657ab
SHA256179027517e90f9e8173f63ba247d7c0d414259fdef3a29a5692c85d84dce557d
SHA51209c0573e2f4db331714d86d32abf9623b5a9560c1e7ac8359a0ef434cc79940143e837a2674aa5140b79e1b1302faf75df9959d184109aad231db78a90139233