Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 04:23
Behavioral task
behavioral1
Sample
b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe
Resource
win7-20240903-en
General
-
Target
b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe
-
Size
45KB
-
MD5
7ace559d317742937e8254dc6da92a7e
-
SHA1
e4986e5b11b96bedc62af5cfb3b48bed58d8d1c9
-
SHA256
b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f
-
SHA512
2c50337078075dc6bfd8b02d77d4de8e5b9ad5b01deed1a3b4f3eb0b2d21efce2736e74d5cf94fdf937bcc2a51c2ecf98022049c706350feacb079c4b968d5d3
-
SSDEEP
768:hukaVT3ongoWU2zjimo2qrrKjGKG6PIyzjbFgX3ij8z+vfYO4qHBDZMhd:hukaVT3QR2mKYDy3bCXSjlfYQdMd
Malware Config
Extracted
asyncrat
0.5.7B
Default
96.248.52.125:8031
adobe_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
update.exe
-
install_folder
%Temp%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0012000000011960-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe -
Executes dropped EXE 1 IoCs
pid Process 976 update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4452 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3192 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe Token: SeDebugPrivilege 976 update.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3644 wrote to memory of 264 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 82 PID 3644 wrote to memory of 264 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 82 PID 3644 wrote to memory of 264 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 82 PID 3644 wrote to memory of 4640 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 84 PID 3644 wrote to memory of 4640 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 84 PID 3644 wrote to memory of 4640 3644 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 84 PID 4640 wrote to memory of 4452 4640 cmd.exe 86 PID 4640 wrote to memory of 4452 4640 cmd.exe 86 PID 4640 wrote to memory of 4452 4640 cmd.exe 86 PID 264 wrote to memory of 3192 264 cmd.exe 87 PID 264 wrote to memory of 3192 264 cmd.exe 87 PID 264 wrote to memory of 3192 264 cmd.exe 87 PID 4640 wrote to memory of 976 4640 cmd.exe 88 PID 4640 wrote to memory of 976 4640 cmd.exe 88 PID 4640 wrote to memory of 976 4640 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe"C:\Users\Admin\AppData\Local\Temp\b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Local\Temp\update.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Local\Temp\update.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA9CD.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5865fd2f4b435f0cbb25a1212c8507a54
SHA109b5367d043e34b523649164ce297ee502216a1e
SHA256d9a2837d1df8d4a10ada8448f18de79a97d1bd3456d5a61ed37fd4ac9bf83a4c
SHA512f396b1e9f14230200e34ddb93aefbbb540051b9c2d41f268ffafc740fa74366f5df4e80372f3df3ce641d9a39329a1da2dee0474dbd17194b4c9ef13963d8ea5
-
Filesize
45KB
MD57ace559d317742937e8254dc6da92a7e
SHA1e4986e5b11b96bedc62af5cfb3b48bed58d8d1c9
SHA256b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f
SHA5122c50337078075dc6bfd8b02d77d4de8e5b9ad5b01deed1a3b4f3eb0b2d21efce2736e74d5cf94fdf937bcc2a51c2ecf98022049c706350feacb079c4b968d5d3