Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 16:31
Behavioral task
behavioral1
Sample
727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe
Resource
win7-20240903-en
General
-
Target
727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe
-
Size
47KB
-
MD5
c8d7a1fbf24efd3a9ef031b81a4fbdcb
-
SHA1
1147ff4e42c33ce3795422d3309f83e3460dba6b
-
SHA256
727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4
-
SHA512
b6c5415e31aef5acd04ccb969916f2184232bcbcca9a5f691eb4cb79e9f40cba8e3ca53d55cba072e34165b1e8ad55564f2121540d178a76165d866a8279bd6a
-
SSDEEP
768:YuW01Towx/9WU9mp+Xmo2qzQh+JRVLiCPIsAKjILU0bu0kv/TRTXfuO6fcIuyvBQ:YuW01ToqEO2MLliLsAKjEbu0a/TRbWOt
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:4444
70.104.186.131:6606
70.104.186.131:7707
70.104.186.131:8808
70.104.186.131:4444
P7nH82MyXxoq
-
delay
3
-
install
true
-
install_file
windowsappsec.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000200000001e746-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe -
Executes dropped EXE 1 IoCs
pid Process 4540 windowsappsec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsappsec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2904 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe Token: SeDebugPrivilege 4540 windowsappsec.exe Token: SeDebugPrivilege 4540 windowsappsec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2076 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 85 PID 1068 wrote to memory of 2076 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 85 PID 1068 wrote to memory of 2076 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 85 PID 1068 wrote to memory of 2164 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 87 PID 1068 wrote to memory of 2164 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 87 PID 1068 wrote to memory of 2164 1068 727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe 87 PID 2076 wrote to memory of 1900 2076 cmd.exe 89 PID 2076 wrote to memory of 1900 2076 cmd.exe 89 PID 2076 wrote to memory of 1900 2076 cmd.exe 89 PID 2164 wrote to memory of 2904 2164 cmd.exe 90 PID 2164 wrote to memory of 2904 2164 cmd.exe 90 PID 2164 wrote to memory of 2904 2164 cmd.exe 90 PID 2164 wrote to memory of 4540 2164 cmd.exe 91 PID 2164 wrote to memory of 4540 2164 cmd.exe 91 PID 2164 wrote to memory of 4540 2164 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe"C:\Users\Admin\AppData\Local\Temp\727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsappsec" /tr '"C:\Users\Admin\AppData\Roaming\windowsappsec.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windowsappsec" /tr '"C:\Users\Admin\AppData\Roaming\windowsappsec.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD060.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2904
-
-
C:\Users\Admin\AppData\Roaming\windowsappsec.exe"C:\Users\Admin\AppData\Roaming\windowsappsec.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD57c659f7b80793ecd2e1041d6b72f5e3c
SHA100ed133e8dd29630402db98b2807c2438fb587fb
SHA256389728734658433d54d1334f15180096102e979f4627a03c43d00a1746615506
SHA512fb6bb484c7bc6c2e883b7cdae2130d505dda8d97a65c5b241737c35a7ef76dfab54fd9443b9f8cca67f9f4b424b746b1364244a8e41cce6404339e82e1b6a231
-
Filesize
47KB
MD5c8d7a1fbf24efd3a9ef031b81a4fbdcb
SHA11147ff4e42c33ce3795422d3309f83e3460dba6b
SHA256727704989958642937c6bd8a84903b74a1fc1841e791c239a055573b0fe628c4
SHA512b6c5415e31aef5acd04ccb969916f2184232bcbcca9a5f691eb4cb79e9f40cba8e3ca53d55cba072e34165b1e8ad55564f2121540d178a76165d866a8279bd6a