Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
xxx.ps1
Resource
win7-20240903-en
General
-
Target
xxx.ps1
-
Size
2.0MB
-
MD5
4e71954ab5a47de9f74938dc0cd3c84f
-
SHA1
781b4cffead59d083d301c7eec7d55250b5a4317
-
SHA256
3b8fc9046c06420b3382cf851595370e4bb75ad0330c44515ad6bedb286dbfc7
-
SHA512
3a44a383686308352a5499d21a30317c61ea8caa81145001af22f5de536a2f3e73da43fafca53696be3923e86bb8780e5b503c3e5f379c1407362fca3909cd80
-
SSDEEP
24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbIm:biMSNKLq1zjAU
Malware Config
Extracted
asyncrat
A 12
MuGz_New
sasaa.kozow.com:6606
AsyncMutex_fsasaa.kozow.com
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 3164 AutoHotkey64.exe 4404 AutoHotkey64.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 3164 set thread context of 3052 3164 AutoHotkey64.exe 87 PID 3164 set thread context of 428 3164 AutoHotkey64.exe 88 PID 3164 set thread context of 2864 3164 AutoHotkey64.exe 90 PID 4404 set thread context of 4936 4404 AutoHotkey64.exe 110 PID 4404 set thread context of 4508 4404 AutoHotkey64.exe 111 PID 4404 set thread context of 4728 4404 AutoHotkey64.exe 112 PID 4404 set thread context of 1628 4404 AutoHotkey64.exe 113 -
pid Process 4060 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4060 powershell.exe 4060 powershell.exe 3164 AutoHotkey64.exe 3164 AutoHotkey64.exe 3164 AutoHotkey64.exe 3164 AutoHotkey64.exe 2864 AddInProcess32.exe 4404 AutoHotkey64.exe 4404 AutoHotkey64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 2864 AddInProcess32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3164 AutoHotkey64.exe 3164 AutoHotkey64.exe 4404 AutoHotkey64.exe 4404 AutoHotkey64.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3164 AutoHotkey64.exe 3164 AutoHotkey64.exe 4404 AutoHotkey64.exe 4404 AutoHotkey64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2864 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3164 4060 powershell.exe 84 PID 4060 wrote to memory of 3164 4060 powershell.exe 84 PID 4060 wrote to memory of 900 4060 powershell.exe 85 PID 4060 wrote to memory of 900 4060 powershell.exe 85 PID 3164 wrote to memory of 400 3164 AutoHotkey64.exe 86 PID 3164 wrote to memory of 400 3164 AutoHotkey64.exe 86 PID 3164 wrote to memory of 400 3164 AutoHotkey64.exe 86 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 3052 3164 AutoHotkey64.exe 87 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 428 3164 AutoHotkey64.exe 88 PID 3164 wrote to memory of 964 3164 AutoHotkey64.exe 89 PID 3164 wrote to memory of 964 3164 AutoHotkey64.exe 89 PID 3164 wrote to memory of 964 3164 AutoHotkey64.exe 89 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 3164 wrote to memory of 2864 3164 AutoHotkey64.exe 90 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4936 4404 AutoHotkey64.exe 110 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4508 4404 AutoHotkey64.exe 111 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 4728 4404 AutoHotkey64.exe 112 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 PID 4404 wrote to memory of 1628 4404 AutoHotkey64.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xxx.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Public\Documents\AutoHotkey64.exe"C:\Users\Public\Documents\AutoHotkey64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:400
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 09:22 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:900
-
-
C:\Users\Public\Documents\AutoHotkey64.exeC:\Users\Public\Documents\AutoHotkey64.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1628
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
272KB
MD54bfa7384c7f4e87897bbeea936d09b8c
SHA1d7cca921fa1882fab95ba13ed7c9ccadb8d8b582
SHA256dc25bb34493e3d16fc0cec229afe3827908c4f9025f9af96a694e2efcfd598c6
SHA5127494a11541335526c8f5b37509466bb50c148a0e6b86f97227b9e37dfe7d7c0b58e4f357fa52d7acee12fc506b84008ec9ddd28077a2f400a5b42b9c4373ac9f
-
Filesize
6KB
MD5a51d3cc02396652ac39de494e7d725d6
SHA1e4659a4561ac38659f7786f78485086aa1573036
SHA256d2fb28bbafa9b105bed3334225778451529cbb2f847594021cccfab7f7d69c5d
SHA512a4d2d3ca7d4d7ca7dcdcd8f7a46004ade1cff22f335b488972070d83602fb30d0b684fda4cd2677ccefb7afdabceb1d642152759b2f6c1796f3011dad272dda8
-
Filesize
1.3MB
MD52d0600fe2b1b3bdc45d833ca32a37fdb
SHA1e9a7411bfef54050de3b485833556f84cabd6e41
SHA256effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
SHA5129891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703