Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:12
Static task
static1
Behavioral task
behavioral1
Sample
1 PROCESO FRAUDE FISCAL.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1 PROCESO FRAUDE FISCAL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
tak_deco_lib.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
tak_deco_lib.dll
Resource
win10v2004-20241007-en
General
-
Target
1 PROCESO FRAUDE FISCAL.exe
-
Size
12.0MB
-
MD5
a7118dffeac3772076f1a39a364d608d
-
SHA1
6b984d9446f23579e154ec47437b9cf820fd6b67
-
SHA256
f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0
-
SHA512
f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890
-
SSDEEP
98304:ReAtQzKADvk/9TEaImN9/tiHBIn8c3hCEFRUTaZnPZOtXwH:ReAOWOM/FE1mNHiFc3hr7UTaZnhOtXwH
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
PLATA
powerupsnew.dynuddns.com:7474
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1096 set thread context of 3336 1096 1 PROCESO FRAUDE FISCAL.exe 84 PID 3336 set thread context of 1232 3336 cmd.exe 106 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1096 1 PROCESO FRAUDE FISCAL.exe 1096 1 PROCESO FRAUDE FISCAL.exe 3336 cmd.exe 3336 cmd.exe 1232 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1096 1 PROCESO FRAUDE FISCAL.exe 3336 cmd.exe 3336 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1232 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1232 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1096 wrote to memory of 3336 1096 1 PROCESO FRAUDE FISCAL.exe 84 PID 1096 wrote to memory of 3336 1096 1 PROCESO FRAUDE FISCAL.exe 84 PID 1096 wrote to memory of 3336 1096 1 PROCESO FRAUDE FISCAL.exe 84 PID 1096 wrote to memory of 3336 1096 1 PROCESO FRAUDE FISCAL.exe 84 PID 3336 wrote to memory of 1232 3336 cmd.exe 106 PID 3336 wrote to memory of 1232 3336 cmd.exe 106 PID 3336 wrote to memory of 1232 3336 cmd.exe 106 PID 3336 wrote to memory of 1232 3336 cmd.exe 106 PID 3336 wrote to memory of 1232 3336 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1 PROCESO FRAUDE FISCAL.exe"C:\Users\Admin\AppData\Local\Temp\1 PROCESO FRAUDE FISCAL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD5379dfe1c77e1f24a0f789abd66a43f31
SHA1ee6c76fdc34bde39a9ffdb95246bb22fa8c28391
SHA2569b74597acec5d64e9f165819001433be6ee22114fc733eef9ffea17de3274a7d
SHA512f15efafe896bae11543c8dc49806275f3ca37d3d63e778d9b9ab93a2c5b5d6cda006affaaf259310373fd83bca7303497588f91c1156251f991f013755b9d898