Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 09:25
Static task
static1
Behavioral task
behavioral1
Sample
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
Resource
win7-20241010-en
General
-
Target
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
-
Size
1.9MB
-
MD5
05ca50471d9f5c01b66e448ea589c149
-
SHA1
889ba922194d17cc453bf5a48505a570b9e9b609
-
SHA256
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28
-
SHA512
cae798186c385752728cf9b63e8eac4672ebc57d3ef3aa83ceeacf9b5e91924fe994047c4c9f0024cee062e6d1fdcba238076beb72478fd7f8621f6aabd7dac9
-
SSDEEP
24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbIB:biMSNKLq1zjAj
Malware Config
Extracted
asyncrat
AWS | 3Losh
s2
menitalnewways.webredirect.org:6606
menitalnewways.webredirect.org:7707
menitalnewways.webredirect.org:8808
menitalnewways.webredirect.org:333
winter1
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 2252 AutoHotkey64.exe 4452 AutoHotkey64.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 2252 set thread context of 3996 2252 AutoHotkey64.exe 87 PID 2252 set thread context of 1108 2252 AutoHotkey64.exe 88 PID 2252 set thread context of 2308 2252 AutoHotkey64.exe 89 PID 4452 set thread context of 1672 4452 AutoHotkey64.exe 102 PID 4452 set thread context of 4564 4452 AutoHotkey64.exe 103 PID 4452 set thread context of 2876 4452 AutoHotkey64.exe 104 PID 4452 set thread context of 4804 4452 AutoHotkey64.exe 105 -
pid Process 2188 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2188 powershell.exe 2188 powershell.exe 2252 AutoHotkey64.exe 2252 AutoHotkey64.exe 2252 AutoHotkey64.exe 2252 AutoHotkey64.exe 3996 AddInProcess32.exe 4452 AutoHotkey64.exe 4452 AutoHotkey64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2188 powershell.exe Token: SeDebugPrivilege 3996 AddInProcess32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2252 AutoHotkey64.exe 2252 AutoHotkey64.exe 4452 AutoHotkey64.exe 4452 AutoHotkey64.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2252 AutoHotkey64.exe 2252 AutoHotkey64.exe 4452 AutoHotkey64.exe 4452 AutoHotkey64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3996 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2252 2188 powershell.exe 84 PID 2188 wrote to memory of 2252 2188 powershell.exe 84 PID 2188 wrote to memory of 2020 2188 powershell.exe 85 PID 2188 wrote to memory of 2020 2188 powershell.exe 85 PID 2252 wrote to memory of 4408 2252 AutoHotkey64.exe 86 PID 2252 wrote to memory of 4408 2252 AutoHotkey64.exe 86 PID 2252 wrote to memory of 4408 2252 AutoHotkey64.exe 86 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 3996 2252 AutoHotkey64.exe 87 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 1108 2252 AutoHotkey64.exe 88 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 2308 2252 AutoHotkey64.exe 89 PID 2252 wrote to memory of 344 2252 AutoHotkey64.exe 90 PID 2252 wrote to memory of 344 2252 AutoHotkey64.exe 90 PID 2252 wrote to memory of 344 2252 AutoHotkey64.exe 90 PID 4452 wrote to memory of 1228 4452 AutoHotkey64.exe 101 PID 4452 wrote to memory of 1228 4452 AutoHotkey64.exe 101 PID 4452 wrote to memory of 1228 4452 AutoHotkey64.exe 101 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 1672 4452 AutoHotkey64.exe 102 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 4564 4452 AutoHotkey64.exe 103 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 2876 4452 AutoHotkey64.exe 104 PID 4452 wrote to memory of 4804 4452 AutoHotkey64.exe 105 PID 4452 wrote to memory of 4804 4452 AutoHotkey64.exe 105 PID 4452 wrote to memory of 4804 4452 AutoHotkey64.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Public\Documents\AutoHotkey64.exe"C:\Users\Public\Documents\AutoHotkey64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:4408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2308
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:344
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 09:27 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2020
-
-
C:\Users\Public\Documents\AutoHotkey64.exeC:\Users\Public\Documents\AutoHotkey64.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:1228
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
255KB
MD5333b12a1b009299e03b34c7972d8de9c
SHA1804acd0591d6fe8507cb20d7b2da9de52ee35be3
SHA2567b4f5e1c35fa4c7c0082bdb107ef27438053dca0ac1393cdbed71c01984fb039
SHA512f4d9af4a0dd2b20ee88a54c09f32b70b5734318df2b4390eaec05b21bd6534eed7e24e686add8960aff18b9ab744a08353249a250639d48b2dba53ee3af7f225
-
Filesize
6KB
MD5a51d3cc02396652ac39de494e7d725d6
SHA1e4659a4561ac38659f7786f78485086aa1573036
SHA256d2fb28bbafa9b105bed3334225778451529cbb2f847594021cccfab7f7d69c5d
SHA512a4d2d3ca7d4d7ca7dcdcd8f7a46004ade1cff22f335b488972070d83602fb30d0b684fda4cd2677ccefb7afdabceb1d642152759b2f6c1796f3011dad272dda8
-
Filesize
1.3MB
MD52d0600fe2b1b3bdc45d833ca32a37fdb
SHA1e9a7411bfef54050de3b485833556f84cabd6e41
SHA256effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
SHA5129891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703