Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 04:57
Behavioral task
behavioral1
Sample
d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe
Resource
win7-20240903-en
General
-
Target
d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe
-
Size
48KB
-
MD5
dfeaafa71cc4f33a546b050aefb83519
-
SHA1
3b34503a035774a83927fb5fc99a060c84e9b9e9
-
SHA256
d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f
-
SHA512
70c9ea4f9ee001648d85e11c6b6bc316b83c29866b97cb60fe2dc8f0994a721dcc77d9930020e5bbd19cab53a58cdf13c9af8d2f46d8e492d5e8e28d4c6763d4
-
SSDEEP
768:zukaVT3ongoWU2Gjimo2qrInm5FtxsWPIsm3TcSU0bFrBM/WTepY8hUudDHBkSJx:zukaVT3Q+27OHxsfsm3tbBrTIh7HeS5V
Malware Config
Extracted
asyncrat
0.5.8
Default
14.243.221.170:3322
ynBzTukwLg8N
-
delay
3
-
install
true
-
install_file
roIrMC.exe
-
install_folder
%Temp%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023cbf-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe -
Executes dropped EXE 1 IoCs
pid Process 1980 roIrMC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roIrMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4900 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3604 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe Token: SeDebugPrivilege 1980 roIrMC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 780 wrote to memory of 1096 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 85 PID 780 wrote to memory of 1096 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 85 PID 780 wrote to memory of 1096 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 85 PID 780 wrote to memory of 3460 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 87 PID 780 wrote to memory of 3460 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 87 PID 780 wrote to memory of 3460 780 d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe 87 PID 1096 wrote to memory of 3604 1096 cmd.exe 90 PID 1096 wrote to memory of 3604 1096 cmd.exe 90 PID 1096 wrote to memory of 3604 1096 cmd.exe 90 PID 3460 wrote to memory of 4900 3460 cmd.exe 89 PID 3460 wrote to memory of 4900 3460 cmd.exe 89 PID 3460 wrote to memory of 4900 3460 cmd.exe 89 PID 3460 wrote to memory of 1980 3460 cmd.exe 91 PID 3460 wrote to memory of 1980 3460 cmd.exe 91 PID 3460 wrote to memory of 1980 3460 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe"C:\Users\Admin\AppData\Local\Temp\d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "roIrMC" /tr '"C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "roIrMC" /tr '"C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9579.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5dfeaafa71cc4f33a546b050aefb83519
SHA13b34503a035774a83927fb5fc99a060c84e9b9e9
SHA256d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f
SHA51270c9ea4f9ee001648d85e11c6b6bc316b83c29866b97cb60fe2dc8f0994a721dcc77d9930020e5bbd19cab53a58cdf13c9af8d2f46d8e492d5e8e28d4c6763d4
-
Filesize
153B
MD5737fb5cc5b41b21b981c2e620fe90aac
SHA134e1235ac47c75caf9825ea7b060b4a48a115723
SHA256bbe86cb67721013d3d3c48b33af290c16f252a33cca3d2835b4e1e044bc386d7
SHA512e01d026f4aa9f077f2c7e59e9ef8fb54127474ae741dae1e6fe29a1d6d4885748cf1501a4873936afb17a88d64794ea42b458d3dd530baf51acfd5a5677040c9