Resubmissions
18-12-2024 14:46
241218-r5shsasndt 1018-12-2024 14:46
241218-r49qnssncw 1018-12-2024 14:15
241218-rknn4a1res 10Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 14:46
General
-
Target
b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe
-
Size
45KB
-
MD5
7ace559d317742937e8254dc6da92a7e
-
SHA1
e4986e5b11b96bedc62af5cfb3b48bed58d8d1c9
-
SHA256
b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f
-
SHA512
2c50337078075dc6bfd8b02d77d4de8e5b9ad5b01deed1a3b4f3eb0b2d21efce2736e74d5cf94fdf937bcc2a51c2ecf98022049c706350feacb079c4b968d5d3
-
SSDEEP
768:hukaVT3ongoWU2zjimo2qrrKjGKG6PIyzjbFgX3ij8z+vfYO4qHBDZMhd:hukaVT3QR2mKYDy3bCXSjlfYQdMd
Malware Config
Extracted
asyncrat
0.5.7B
Default
96.248.52.125:8031
adobe_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
update.exe
-
install_folder
%Temp%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000018bdd-13.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1860 update.exe -
Loads dropped DLL 1 IoCs
pid Process 2064 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2872 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe Token: SeDebugPrivilege 1860 update.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2272 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 30 PID 2260 wrote to memory of 2272 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 30 PID 2260 wrote to memory of 2272 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 30 PID 2260 wrote to memory of 2272 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 30 PID 2260 wrote to memory of 2064 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 32 PID 2260 wrote to memory of 2064 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 32 PID 2260 wrote to memory of 2064 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 32 PID 2260 wrote to memory of 2064 2260 b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe 32 PID 2272 wrote to memory of 2488 2272 cmd.exe 34 PID 2272 wrote to memory of 2488 2272 cmd.exe 34 PID 2272 wrote to memory of 2488 2272 cmd.exe 34 PID 2272 wrote to memory of 2488 2272 cmd.exe 34 PID 2064 wrote to memory of 2872 2064 cmd.exe 35 PID 2064 wrote to memory of 2872 2064 cmd.exe 35 PID 2064 wrote to memory of 2872 2064 cmd.exe 35 PID 2064 wrote to memory of 2872 2064 cmd.exe 35 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36 PID 2064 wrote to memory of 1860 2064 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe"C:\Users\Admin\AppData\Local\Temp\b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Local\Temp\update.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Local\Temp\update.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD76B.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5ada04e56e94a9f8d3c0a758072f1f821
SHA1ba37add81690ef9ef0c4660c520b594114332dfb
SHA25647476aa975615f3bb46cd77eecdf7ec87cad3cacae2c2c75bf28ba9eca07938d
SHA512b31c5bcf247ea8d087bef76d914c71cee7a06501f95a02f7d695ab2cd985dd2a37c373bae9621b564f9c8ef2dbb196e3dd42ce4ba6572da715f70368c1a1a80d
-
Filesize
45KB
MD57ace559d317742937e8254dc6da92a7e
SHA1e4986e5b11b96bedc62af5cfb3b48bed58d8d1c9
SHA256b6c58155365a5e35952e46611fd7b43e36e256903bff2030bc07a3c6841b836f
SHA5122c50337078075dc6bfd8b02d77d4de8e5b9ad5b01deed1a3b4f3eb0b2d21efce2736e74d5cf94fdf937bcc2a51c2ecf98022049c706350feacb079c4b968d5d3