Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 03:00
Behavioral task
behavioral1
Sample
bro.exe
Resource
win7-20240903-en
General
-
Target
bro.exe
-
Size
47KB
-
MD5
83fc5776b79aad95fecd322f11f80187
-
SHA1
412ccb9ab9e743907eef7be3b47568decefbd15f
-
SHA256
e87744178fba28b505eccbf4847a77f84877a8bd8f50ce17f5f6f68a0ea41327
-
SHA512
1552e626f349c66f7e555326e68d97aa87a4971b6c4b912514f1bfa39036d17c9295e88e0f49c349cac2758974e060535044ea4d09a25f2949f45ab79f0c838b
-
SSDEEP
768:MuY69T3kH1jWUvTqRmo2qbRc4wmDPItjd0axq0bE6zrvtOoqJ/UBDZ0x:MuY69T34y2AwmMtjZHbE6/vgMd0x
Malware Config
Extracted
asyncrat
0.5.8
Default
desktop-ukmnq5d-wasda.at.remote.it:33006
tTT9mCTiJnq9
-
delay
3
-
install
true
-
install_file
roar.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c7c-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation bro.exe -
Executes dropped EXE 1 IoCs
pid Process 1588 roar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4200 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe 4248 bro.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4248 bro.exe Token: SeDebugPrivilege 1588 roar.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4248 wrote to memory of 5004 4248 bro.exe 85 PID 4248 wrote to memory of 5004 4248 bro.exe 85 PID 4248 wrote to memory of 5004 4248 bro.exe 85 PID 4248 wrote to memory of 2324 4248 bro.exe 87 PID 4248 wrote to memory of 2324 4248 bro.exe 87 PID 4248 wrote to memory of 2324 4248 bro.exe 87 PID 2324 wrote to memory of 4200 2324 cmd.exe 89 PID 2324 wrote to memory of 4200 2324 cmd.exe 89 PID 2324 wrote to memory of 4200 2324 cmd.exe 89 PID 5004 wrote to memory of 676 5004 cmd.exe 90 PID 5004 wrote to memory of 676 5004 cmd.exe 90 PID 5004 wrote to memory of 676 5004 cmd.exe 90 PID 2324 wrote to memory of 1588 2324 cmd.exe 91 PID 2324 wrote to memory of 1588 2324 cmd.exe 91 PID 2324 wrote to memory of 1588 2324 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bro.exe"C:\Users\Admin\AppData\Local\Temp\bro.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "roar" /tr '"C:\Users\Admin\AppData\Roaming\roar.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "roar" /tr '"C:\Users\Admin\AppData\Roaming\roar.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD031.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4200
-
-
C:\Users\Admin\AppData\Roaming\roar.exe"C:\Users\Admin\AppData\Roaming\roar.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5d3e7a91a737b125cd47a31a5a9ae961e
SHA10c1b5639ca3948c83f797f927ae1eb65de44de46
SHA256a108144b8117e0662f6db7f5a04e8ea6c608092654b91400aa7c71c954b6dfbf
SHA512da3e8aef284e52bc872c53bf2272ce04ba7827e2fcce590990d2074193c4e400c297afabbbdcc8f12558a43229b2fdd6c718ff1dd0aeb1c55fc49030a1a9baad
-
Filesize
47KB
MD583fc5776b79aad95fecd322f11f80187
SHA1412ccb9ab9e743907eef7be3b47568decefbd15f
SHA256e87744178fba28b505eccbf4847a77f84877a8bd8f50ce17f5f6f68a0ea41327
SHA5121552e626f349c66f7e555326e68d97aa87a4971b6c4b912514f1bfa39036d17c9295e88e0f49c349cac2758974e060535044ea4d09a25f2949f45ab79f0c838b