Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 14:05
Behavioral task
behavioral1
Sample
ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe
Resource
win7-20241010-en
General
-
Target
ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe
-
Size
45KB
-
MD5
d3bb7d0cce1e7a1a1884f25d2a5370d2
-
SHA1
ebc5d5104e8de6a53aef7f5d50f44925070a4085
-
SHA256
ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c
-
SHA512
dcc630bd534043caf4c54e5da7fe2daccc64e213b0d2f4dd8bbc13174de3768802e1ea603a1f0584687d0d20d750e96dcd9ec2b46401a442d6a3943972142e06
-
SSDEEP
768:hu4f9TskvpDWUPANxmo2qbgY8Vq0H9OPIozjbmgX3iEzO/uoXXgxMqJvsZzBDZ7r:hu4f9TswI27ss3o3b5XS8O/XJ7d7r
Malware Config
Extracted
asyncrat
0.5.7B
services
shadowdx.duckdns.org:8808
windows services
-
delay
3
-
install
true
-
install_file
services.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023ca5-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe -
Executes dropped EXE 1 IoCs
pid Process 4648 services.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4132 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe Token: SeDebugPrivilege 4648 services.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4020 wrote to memory of 3380 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 82 PID 4020 wrote to memory of 3380 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 82 PID 4020 wrote to memory of 3380 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 82 PID 4020 wrote to memory of 3100 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 83 PID 4020 wrote to memory of 3100 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 83 PID 4020 wrote to memory of 3100 4020 ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe 83 PID 3100 wrote to memory of 4132 3100 cmd.exe 86 PID 3100 wrote to memory of 4132 3100 cmd.exe 86 PID 3100 wrote to memory of 4132 3100 cmd.exe 86 PID 3380 wrote to memory of 3940 3380 cmd.exe 87 PID 3380 wrote to memory of 3940 3380 cmd.exe 87 PID 3380 wrote to memory of 3940 3380 cmd.exe 87 PID 3100 wrote to memory of 4648 3100 cmd.exe 92 PID 3100 wrote to memory of 4648 3100 cmd.exe 92 PID 3100 wrote to memory of 4648 3100 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe"C:\Users\Admin\AppData\Local\Temp\ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr '"C:\Users\Admin\AppData\Roaming\services.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services" /tr '"C:\Users\Admin\AppData\Roaming\services.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBECC.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4132
-
-
C:\Users\Admin\AppData\Roaming\services.exe"C:\Users\Admin\AppData\Roaming\services.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54c92935306f21c038171af94e08a118c
SHA19528ed683b8c039d09c96e1b721eaa1180bd8fb5
SHA256e76fd73198e06d394fba3acd34e89839568344d1edcbdad286d955f922ad807e
SHA512126cddb9661d86afd336832c92011d8c7116956211784048317fbeb7d91aea303a5b4efb22df331d91d8fcadf6c0caa83da7728eb4f4b502b0b0a2b634bd167d
-
Filesize
45KB
MD5d3bb7d0cce1e7a1a1884f25d2a5370d2
SHA1ebc5d5104e8de6a53aef7f5d50f44925070a4085
SHA256ea568b732e66798cdc9f97f736cc77142d08e1996b7f5d6a996d9b941083e03c
SHA512dcc630bd534043caf4c54e5da7fe2daccc64e213b0d2f4dd8bbc13174de3768802e1ea603a1f0584687d0d20d750e96dcd9ec2b46401a442d6a3943972142e06