Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 12:40
Behavioral task
behavioral1
Sample
eeeeeeeeeeeeeeeeeeeee.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
eeeeeeeeeeeeeeeeeeeee.exe
-
Size
47KB
-
MD5
70dea4658bea5bf00ef8c0578693d6fa
-
SHA1
814cf65c3cc2394a8a2bab4997f28c46f1976e41
-
SHA256
85a8267c923fccae9397ee2f05dead67d8877145b175f6836940a28fa96ca4ae
-
SHA512
348990ee46dc1d19b7a697b81949b22dbca9af203d9ba2cb06036f82cace988b160a3a45193abf67f014ea2c44db9c4540771c8d4f179f9991cf8754ec563e39
-
SSDEEP
768:gusPr1TUq7qMFPWUDVGotmo2qzY5HCdS7eU/t+PIG+BXqm0b6nu4tqCy1cftNBDc:gusj1TUfMso2VJT7vtHGK8b6nltWcfRY
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:80
Mutex
wpqzdX1ij9YS
Attributes
-
delay
3
-
install
true
-
install_file
aa.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023ba0-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation eeeeeeeeeeeeeeeeeeeee.exe -
Executes dropped EXE 1 IoCs
pid Process 2452 aa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eeeeeeeeeeeeeeeeeeeee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1272 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 2884 eeeeeeeeeeeeeeeeeeeee.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2884 eeeeeeeeeeeeeeeeeeeee.exe Token: SeDebugPrivilege 2452 aa.exe Token: SeDebugPrivilege 2452 aa.exe Token: SeDebugPrivilege 1460 taskmgr.exe Token: SeSystemProfilePrivilege 1460 taskmgr.exe Token: SeCreateGlobalPrivilege 1460 taskmgr.exe Token: 33 1460 taskmgr.exe Token: SeIncBasePriorityPrivilege 1460 taskmgr.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe 1460 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2884 wrote to memory of 4364 2884 eeeeeeeeeeeeeeeeeeeee.exe 82 PID 2884 wrote to memory of 4364 2884 eeeeeeeeeeeeeeeeeeeee.exe 82 PID 2884 wrote to memory of 4364 2884 eeeeeeeeeeeeeeeeeeeee.exe 82 PID 2884 wrote to memory of 3500 2884 eeeeeeeeeeeeeeeeeeeee.exe 84 PID 2884 wrote to memory of 3500 2884 eeeeeeeeeeeeeeeeeeeee.exe 84 PID 2884 wrote to memory of 3500 2884 eeeeeeeeeeeeeeeeeeeee.exe 84 PID 3500 wrote to memory of 1272 3500 cmd.exe 86 PID 3500 wrote to memory of 1272 3500 cmd.exe 86 PID 3500 wrote to memory of 1272 3500 cmd.exe 86 PID 4364 wrote to memory of 2180 4364 cmd.exe 87 PID 4364 wrote to memory of 2180 4364 cmd.exe 87 PID 4364 wrote to memory of 2180 4364 cmd.exe 87 PID 3500 wrote to memory of 2452 3500 cmd.exe 92 PID 3500 wrote to memory of 2452 3500 cmd.exe 92 PID 3500 wrote to memory of 2452 3500 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeeeeeeeeee.exe"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeeeeeeeeee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "aa" /tr '"C:\Users\Admin\AppData\Roaming\aa.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "aa" /tr '"C:\Users\Admin\AppData\Roaming\aa.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1272
-
-
C:\Users\Admin\AppData\Roaming\aa.exe"C:\Users\Admin\AppData\Roaming\aa.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD55bfa5bc14a184481d1a3207f4085f32f
SHA19011ba3cd464e031f50334fa845e1657479ea4e2
SHA2563c110249bab407de81177fea91b997bdef278c74d72ecd9465ddbaa55a4a9351
SHA512226a374f17b1ca3bf6735dd5039d8fb64b998d299c18bf32cbf4e817d1927bfe57e3c5f1a7ec95a63cc26e490cb3632932fffbccf4a2780ab999e1672d36c55c
-
Filesize
47KB
MD570dea4658bea5bf00ef8c0578693d6fa
SHA1814cf65c3cc2394a8a2bab4997f28c46f1976e41
SHA25685a8267c923fccae9397ee2f05dead67d8877145b175f6836940a28fa96ca4ae
SHA512348990ee46dc1d19b7a697b81949b22dbca9af203d9ba2cb06036f82cace988b160a3a45193abf67f014ea2c44db9c4540771c8d4f179f9991cf8754ec563e39