Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 04:57 UTC

General

  • Target

    d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe

  • Size

    48KB

  • MD5

    dfeaafa71cc4f33a546b050aefb83519

  • SHA1

    3b34503a035774a83927fb5fc99a060c84e9b9e9

  • SHA256

    d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f

  • SHA512

    70c9ea4f9ee001648d85e11c6b6bc316b83c29866b97cb60fe2dc8f0994a721dcc77d9930020e5bbd19cab53a58cdf13c9af8d2f46d8e492d5e8e28d4c6763d4

  • SSDEEP

    768:zukaVT3ongoWU2Gjimo2qrInm5FtxsWPIsm3TcSU0bFrBM/WTepY8hUudDHBkSJx:zukaVT3Q+27OHxsfsm3tbBrTIh7HeS5V

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

14.243.221.170:3322

Mutex

ynBzTukwLg8N

Attributes
  • delay

    3

  • install

    true

  • install_file

    roIrMC.exe

  • install_folder

    %Temp%

aes.plain
1
gi9GetYdJhVNpQ8EeSRDBjXZndLXRbWA

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe
    "C:\Users\Admin\AppData\Local\Temp\d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "roIrMC" /tr '"C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"' & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "roIrMC" /tr '"C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"'
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3604
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9579.tmp.bat""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:4900
      • C:\Users\Admin\AppData\Local\Temp\roIrMC.exe
        "C:\Users\Admin\AppData\Local\Temp\roIrMC.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1980

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 14.243.221.170:3322
    roIrMC.exe
    260 B
    5
  • 14.243.221.170:3322
    roIrMC.exe
    260 B
    5
  • 14.243.221.170:3322
    roIrMC.exe
    260 B
    5
  • 14.243.221.170:3322
    roIrMC.exe
    260 B
    5
  • 14.243.221.170:3322
    roIrMC.exe
    260 B
    5
  • 14.243.221.170:3322
    roIrMC.exe
    208 B
    4
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\roIrMC.exe

    Filesize

    48KB

    MD5

    dfeaafa71cc4f33a546b050aefb83519

    SHA1

    3b34503a035774a83927fb5fc99a060c84e9b9e9

    SHA256

    d94acc2a29273419227c070be66a652e5d074de175d0ec572bf9dee2f833703f

    SHA512

    70c9ea4f9ee001648d85e11c6b6bc316b83c29866b97cb60fe2dc8f0994a721dcc77d9930020e5bbd19cab53a58cdf13c9af8d2f46d8e492d5e8e28d4c6763d4

  • C:\Users\Admin\AppData\Local\Temp\tmp9579.tmp.bat

    Filesize

    153B

    MD5

    737fb5cc5b41b21b981c2e620fe90aac

    SHA1

    34e1235ac47c75caf9825ea7b060b4a48a115723

    SHA256

    bbe86cb67721013d3d3c48b33af290c16f252a33cca3d2835b4e1e044bc386d7

    SHA512

    e01d026f4aa9f077f2c7e59e9ef8fb54127474ae741dae1e6fe29a1d6d4885748cf1501a4873936afb17a88d64794ea42b458d3dd530baf51acfd5a5677040c9

  • memory/780-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

    Filesize

    4KB

  • memory/780-1-0x0000000000D60000-0x0000000000D72000-memory.dmp

    Filesize

    72KB

  • memory/780-2-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

  • memory/780-3-0x0000000005720000-0x00000000057BC000-memory.dmp

    Filesize

    624KB

  • memory/780-8-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

  • memory/1980-13-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

  • memory/1980-14-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.