Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 05:13
Behavioral task
behavioral1
Sample
e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe
Resource
win7-20240903-en
General
-
Target
e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe
-
Size
47KB
-
MD5
3e7ca285ef320886e388dc9097e1bf92
-
SHA1
c2aaa30acb4c03e041aa5cca350c0095fa6d00f0
-
SHA256
e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97
-
SHA512
34266fb5685485010f076d0fec19ae538f27a9da1cccaf3454117480b7ebe83a612a52b44d651fa35897b237409cabf098ae69c9572f9932adf022f9eb894006
-
SSDEEP
768:cuyJNTAoZjRWUJd9bmo2qLZYPILhlH2PVFf2PIR84WnZQe4bg24mQG76nRqw6zse:cuyJNTAGL2g32Pzf/R83QFbg2bH6RqJX
Malware Config
Extracted
asyncrat
0.5.8
Default
18.ip.gl.ply.gg:6606
18.ip.gl.ply.gg:7707
18.ip.gl.ply.gg:8808
18.ip.gl.ply.gg:9028
HyFTucy74RnH
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b80-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe -
Executes dropped EXE 1 IoCs
pid Process 3584 Discord.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3728 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe Token: SeDebugPrivilege 3584 Discord.exe Token: SeDebugPrivilege 3584 Discord.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 464 wrote to memory of 1052 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 86 PID 464 wrote to memory of 1052 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 86 PID 464 wrote to memory of 1052 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 86 PID 464 wrote to memory of 988 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 88 PID 464 wrote to memory of 988 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 88 PID 464 wrote to memory of 988 464 e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe 88 PID 1052 wrote to memory of 4316 1052 cmd.exe 90 PID 1052 wrote to memory of 4316 1052 cmd.exe 90 PID 1052 wrote to memory of 4316 1052 cmd.exe 90 PID 988 wrote to memory of 3728 988 cmd.exe 91 PID 988 wrote to memory of 3728 988 cmd.exe 91 PID 988 wrote to memory of 3728 988 cmd.exe 91 PID 988 wrote to memory of 3584 988 cmd.exe 92 PID 988 wrote to memory of 3584 988 cmd.exe 92 PID 988 wrote to memory of 3584 988 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe"C:\Users\Admin\AppData\Local\Temp\e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2CA.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3728
-
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD516229fae1e35d955bad0db32926c8f76
SHA1197c7efe76970221e935c9802cd638edfb850a56
SHA2567f094660fd08ee37e2abda53324a387a7a7235d480d1878e8ca1dae1210d106a
SHA5123c86c0d90059c184da3a0a3afc19f41dd096658947d939d4d9adbe46d256445f5cae8d5666f4a8b917c7aa85c20e9e8d37ddcd6a09480fe138966031ce42d31b
-
Filesize
47KB
MD53e7ca285ef320886e388dc9097e1bf92
SHA1c2aaa30acb4c03e041aa5cca350c0095fa6d00f0
SHA256e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97
SHA51234266fb5685485010f076d0fec19ae538f27a9da1cccaf3454117480b7ebe83a612a52b44d651fa35897b237409cabf098ae69c9572f9932adf022f9eb894006