Analysis
-
max time kernel
64s -
max time network
67s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-12-2024 12:55
Errors
Reason
Machine shutdown
General
-
Target
1.exe
-
Size
63KB
-
MD5
cf90a4de10e208d956569255917251fa
-
SHA1
1002b35498b701bb9542aed54c77bc4e66a953ba
-
SHA256
c03f149cdbbcb2c095f92061cecff35bdbde6b3700cfa75ef0e5b12e9929c3bf
-
SHA512
abcb7bc570d5e31478a2e05b9d1c95b8ea076b1d4d7ce370c781ba0879a6ba9fcbc828d4a12ed8ece8751e8457e0351a3a6807301a5b6fe41d4118ffdf8a7cb6
-
SSDEEP
1536:fJxFz3FI8Cwof4wJK7bkyyiNXGbbrwrcqmnGBZVclN:fJxFz3FI8Cwo7JK7bky/JGbbrmDzY
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
fojeweb571-45302.portmap.host:45302
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x001b00000002aaba-11.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 4676 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 748 timeout.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3564 1.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3564 1.exe Token: SeDebugPrivilege 4676 windows defender firewall.exe Token: SeDebugPrivilege 3860 taskmgr.exe Token: SeSystemProfilePrivilege 3860 taskmgr.exe Token: SeCreateGlobalPrivilege 3860 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe 3860 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 LogonUI.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4548 3564 1.exe 77 PID 3564 wrote to memory of 4548 3564 1.exe 77 PID 3564 wrote to memory of 4380 3564 1.exe 78 PID 3564 wrote to memory of 4380 3564 1.exe 78 PID 4548 wrote to memory of 3672 4548 cmd.exe 81 PID 4548 wrote to memory of 3672 4548 cmd.exe 81 PID 4380 wrote to memory of 748 4380 cmd.exe 82 PID 4380 wrote to memory of 748 4380 cmd.exe 82 PID 4380 wrote to memory of 4676 4380 cmd.exe 83 PID 4380 wrote to memory of 4676 4380 cmd.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:3672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9328.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:748
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3860
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a3e855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD532de25ad77a7db4ad4302b93c9ccb178
SHA1ae8d974829d022efc0167dde1522cac1cb08dca2
SHA256af341d06c17af3a02511065df0232c8659990266b5d9c652067536c5ce479427
SHA5125ed4eb8fdbe96c521159743e9846a18589163e6e5e79c5e868d580eaa4933b84883cbfdf9f63b08aca03dd4b4999fc24759841b2488ea3bc35508a5b37246599
-
Filesize
63KB
MD5cf90a4de10e208d956569255917251fa
SHA11002b35498b701bb9542aed54c77bc4e66a953ba
SHA256c03f149cdbbcb2c095f92061cecff35bdbde6b3700cfa75ef0e5b12e9929c3bf
SHA512abcb7bc570d5e31478a2e05b9d1c95b8ea076b1d4d7ce370c781ba0879a6ba9fcbc828d4a12ed8ece8751e8457e0351a3a6807301a5b6fe41d4118ffdf8a7cb6