Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:22
Static task
static1
Behavioral task
behavioral1
Sample
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
Resource
win7-20241010-en
General
-
Target
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
-
Size
1.9MB
-
MD5
05ca50471d9f5c01b66e448ea589c149
-
SHA1
889ba922194d17cc453bf5a48505a570b9e9b609
-
SHA256
e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28
-
SHA512
cae798186c385752728cf9b63e8eac4672ebc57d3ef3aa83ceeacf9b5e91924fe994047c4c9f0024cee062e6d1fdcba238076beb72478fd7f8621f6aabd7dac9
-
SSDEEP
24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbIB:biMSNKLq1zjAj
Malware Config
Extracted
asyncrat
AWS | 3Losh
s2
menitalnewways.webredirect.org:6606
menitalnewways.webredirect.org:7707
menitalnewways.webredirect.org:8808
menitalnewways.webredirect.org:333
winter1
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Executes dropped EXE 2 IoCs
pid Process 2008 AutoHotkey64.exe 2300 AutoHotkey64.exe -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 2008 set thread context of 2608 2008 AutoHotkey64.exe 88 PID 2008 set thread context of 2384 2008 AutoHotkey64.exe 89 PID 2008 set thread context of 640 2008 AutoHotkey64.exe 90 PID 2008 set thread context of 3408 2008 AutoHotkey64.exe 91 PID 2008 set thread context of 2496 2008 AutoHotkey64.exe 92 PID 2300 set thread context of 1104 2300 AutoHotkey64.exe 113 PID 2300 set thread context of 2284 2300 AutoHotkey64.exe 114 PID 2300 set thread context of 4572 2300 AutoHotkey64.exe 115 PID 2300 set thread context of 1148 2300 AutoHotkey64.exe 116 -
pid Process 2260 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1868 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2260 powershell.exe 2260 powershell.exe 2496 AddInProcess32.exe 2300 AutoHotkey64.exe 2300 AutoHotkey64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2260 powershell.exe Token: SeDebugPrivilege 2496 AddInProcess32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2008 AutoHotkey64.exe 2008 AutoHotkey64.exe 2300 AutoHotkey64.exe 2300 AutoHotkey64.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2008 AutoHotkey64.exe 2008 AutoHotkey64.exe 2300 AutoHotkey64.exe 2300 AutoHotkey64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2496 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2008 2260 powershell.exe 86 PID 2260 wrote to memory of 2008 2260 powershell.exe 86 PID 2260 wrote to memory of 1868 2260 powershell.exe 87 PID 2260 wrote to memory of 1868 2260 powershell.exe 87 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2608 2008 AutoHotkey64.exe 88 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 2384 2008 AutoHotkey64.exe 89 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 640 2008 AutoHotkey64.exe 90 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 3408 2008 AutoHotkey64.exe 91 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2008 wrote to memory of 2496 2008 AutoHotkey64.exe 92 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 1104 2300 AutoHotkey64.exe 113 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 2284 2300 AutoHotkey64.exe 114 PID 2300 wrote to memory of 4572 2300 AutoHotkey64.exe 115 PID 2300 wrote to memory of 4572 2300 AutoHotkey64.exe 115 PID 2300 wrote to memory of 4572 2300 AutoHotkey64.exe 115 PID 2300 wrote to memory of 4572 2300 AutoHotkey64.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Public\Documents\AutoHotkey64.exe"C:\Users\Public\Documents\AutoHotkey64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2608
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:24 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1868
-
-
C:\Users\Public\Documents\AutoHotkey64.exeC:\Users\Public\Documents\AutoHotkey64.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
255KB
MD5333b12a1b009299e03b34c7972d8de9c
SHA1804acd0591d6fe8507cb20d7b2da9de52ee35be3
SHA2567b4f5e1c35fa4c7c0082bdb107ef27438053dca0ac1393cdbed71c01984fb039
SHA512f4d9af4a0dd2b20ee88a54c09f32b70b5734318df2b4390eaec05b21bd6534eed7e24e686add8960aff18b9ab744a08353249a250639d48b2dba53ee3af7f225
-
Filesize
6KB
MD5a51d3cc02396652ac39de494e7d725d6
SHA1e4659a4561ac38659f7786f78485086aa1573036
SHA256d2fb28bbafa9b105bed3334225778451529cbb2f847594021cccfab7f7d69c5d
SHA512a4d2d3ca7d4d7ca7dcdcd8f7a46004ade1cff22f335b488972070d83602fb30d0b684fda4cd2677ccefb7afdabceb1d642152759b2f6c1796f3011dad272dda8
-
Filesize
1.3MB
MD52d0600fe2b1b3bdc45d833ca32a37fdb
SHA1e9a7411bfef54050de3b485833556f84cabd6e41
SHA256effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
SHA5129891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703