Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 02:16
Behavioral task
behavioral1
Sample
1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe
Resource
win7-20240903-en
General
-
Target
1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe
-
Size
47KB
-
MD5
17bbb12504a20c0c2544c8dac52ed0a1
-
SHA1
ff9c5d849ee5817d47e1339b7a7c266119352d45
-
SHA256
1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52
-
SHA512
b73ca96a3a51cebeb520b82b25da49785943d0aeeab731080a224c5f0397767ce12744b8f0ab56c9395b49070246badabd915882180592e4e79f7dc1882b7b44
-
SSDEEP
768:MuyJNTAoZjRWUJd9bmo2qLPqjtXVcPICdOYV8AbTkByRPZmRMBDZ0x:MuyJNTAGL2LTCdOajbQARPZmRKd0x
Malware Config
Extracted
asyncrat
0.5.8
Default
18.ip.gl.ply.gg:6606
18.ip.gl.ply.gg:7707
18.ip.gl.ply.gg:8808
18.ip.gl.ply.gg:9028
kLUPkJ05yxZY
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023cab-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe -
Executes dropped EXE 1 IoCs
pid Process 1056 Discord.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2620 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4860 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe Token: SeDebugPrivilege 1056 Discord.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4644 wrote to memory of 4568 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 82 PID 4644 wrote to memory of 4568 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 82 PID 4644 wrote to memory of 4568 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 82 PID 4644 wrote to memory of 552 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 84 PID 4644 wrote to memory of 552 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 84 PID 4644 wrote to memory of 552 4644 1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe 84 PID 552 wrote to memory of 2620 552 cmd.exe 86 PID 552 wrote to memory of 2620 552 cmd.exe 86 PID 552 wrote to memory of 2620 552 cmd.exe 86 PID 4568 wrote to memory of 4860 4568 cmd.exe 87 PID 4568 wrote to memory of 4860 4568 cmd.exe 87 PID 4568 wrote to memory of 4860 4568 cmd.exe 87 PID 552 wrote to memory of 1056 552 cmd.exe 88 PID 552 wrote to memory of 1056 552 cmd.exe 88 PID 552 wrote to memory of 1056 552 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe"C:\Users\Admin\AppData\Local\Temp\1b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8F8E.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2620
-
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD5beadd68e926ff752e32e000a3530860d
SHA1a20d6322098dc350d2b17ac099786bfe2508e388
SHA2561a470392bf4ac6dd4d6c127a3ebd9a49c13820e188dccfcea615563489d6c2d6
SHA512ca08de3c7ee8796ee60cedd6b50053bb794aa6dcf72e389874efd765229a5d9fe5e9d13bb5269cfd3f32337dbc7203a45e11ae6c023c52b8bac719d801389c0c
-
Filesize
47KB
MD517bbb12504a20c0c2544c8dac52ed0a1
SHA1ff9c5d849ee5817d47e1339b7a7c266119352d45
SHA2561b9e97ba99aed432ccc47149bc929f9ad64a16241ac168017205312075600a52
SHA512b73ca96a3a51cebeb520b82b25da49785943d0aeeab731080a224c5f0397767ce12744b8f0ab56c9395b49070246badabd915882180592e4e79f7dc1882b7b44