Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 02:12

General

  • Target

    1 PROCESO FRAUDE FISCAL.exe

  • Size

    12.0MB

  • MD5

    a7118dffeac3772076f1a39a364d608d

  • SHA1

    6b984d9446f23579e154ec47437b9cf820fd6b67

  • SHA256

    f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0

  • SHA512

    f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890

  • SSDEEP

    98304:ReAtQzKADvk/9TEaImN9/tiHBIn8c3hCEFRUTaZnPZOtXwH:ReAOWOM/FE1mNHiFc3hr7UTaZnhOtXwH

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

PLATA

C2

powerupsnew.dynuddns.com:7474

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1 PROCESO FRAUDE FISCAL.exe
    "C:\Users\Admin\AppData\Local\Temp\1 PROCESO FRAUDE FISCAL.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4640f6d6

    Filesize

    780KB

    MD5

    379dfe1c77e1f24a0f789abd66a43f31

    SHA1

    ee6c76fdc34bde39a9ffdb95246bb22fa8c28391

    SHA256

    9b74597acec5d64e9f165819001433be6ee22114fc733eef9ffea17de3274a7d

    SHA512

    f15efafe896bae11543c8dc49806275f3ca37d3d63e778d9b9ab93a2c5b5d6cda006affaaf259310373fd83bca7303497588f91c1156251f991f013755b9d898

  • memory/1096-0-0x00000000008E0000-0x000000000093E000-memory.dmp

    Filesize

    376KB

  • memory/1096-1-0x00007FF98C680000-0x00007FF98C7F2000-memory.dmp

    Filesize

    1.4MB

  • memory/1096-5-0x00007FF98C699000-0x00007FF98C69A000-memory.dmp

    Filesize

    4KB

  • memory/1096-6-0x00007FF98C680000-0x00007FF98C7F2000-memory.dmp

    Filesize

    1.4MB

  • memory/1096-7-0x00000000008E0000-0x000000000093E000-memory.dmp

    Filesize

    376KB

  • memory/1096-8-0x00007FF98C680000-0x00007FF98C7F2000-memory.dmp

    Filesize

    1.4MB

  • memory/1232-24-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1232-26-0x00000000053C0000-0x0000000005452000-memory.dmp

    Filesize

    584KB

  • memory/1232-29-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1232-28-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1232-27-0x00000000053B0000-0x00000000053BA000-memory.dmp

    Filesize

    40KB

  • memory/1232-19-0x0000000073360000-0x00000000745B4000-memory.dmp

    Filesize

    18.3MB

  • memory/1232-22-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1232-23-0x00000000009C0000-0x00000000009D6000-memory.dmp

    Filesize

    88KB

  • memory/1232-25-0x0000000005790000-0x0000000005D34000-memory.dmp

    Filesize

    5.6MB

  • memory/3336-12-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

    Filesize

    2.0MB

  • memory/3336-15-0x0000000074DEE000-0x0000000074DF0000-memory.dmp

    Filesize

    8KB

  • memory/3336-18-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

    Filesize

    1.5MB

  • memory/3336-16-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

    Filesize

    1.5MB

  • memory/3336-14-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

    Filesize

    1.5MB