Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2024 14:20

General

  • Target

    PureRcs Adv Token Grabber‮nls..scr

  • Size

    3.0MB

  • MD5

    29ee9836013142f0f63c6813944c7021

  • SHA1

    90781c0a4d3fe85d1582eb1ca4c5aa910ee85b78

  • SHA256

    7382071535d0b83a8ee62e72c29e8f42d433b29238c4c86cfba7c4de4d6ad6b1

  • SHA512

    482d95357c48dbe380b90980a626fc04446de10e83e31dfbe850de94942091b86f01b83c2efe4517b887b8c288b0689e64809f5ad174deca759eeb9594d2e47e

  • SSDEEP

    49152:oXWsTEkwghTKv4jysGUqgCoOtt1JKLBuhFapNyPn7MU4HcOL:oXFEkwghTKv4jysGUqgCxttiBmas7+8

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

MetaMask

C2

51.103.217.70:6677

Mutex

MetaMask

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Google Chrome

C2

51.103.217.70:8585

Mutex

Google Chrome

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Windows Defender

C2

51.103.217.70:8585

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Expoler

C2

51.103.217.70:6677

Mutex

Expoler

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PureRcs Adv Token Grabber‮nls..scr
    "C:\Users\Admin\AppData\Local\Temp\PureRcs Adv Token Grabber‮nls..scr" /S
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE
      "C:\Users\Admin\AppData\Local\Temp\EDGE.EXE"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE
        "C:\Users\Admin\AppData\Local\Temp\EDGE.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1896
    • C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE
      "C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Google Chrome';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Google Chrome' -Value '"C:\Users\Admin\AppData\Roaming\Google Chrome\Google Chrome.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2732
    • C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE
      "C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'MetaMask';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'MetaMask' -Value '"C:\Users\Admin\AppData\Roaming\MetaMask\MetaMask.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2788
    • C:\Users\Admin\AppData\Local\Temp\RUNING.EXE
      "C:\Users\Admin\AppData\Local\Temp\RUNING.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Runing';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Runing' -Value '"C:\Users\Admin\AppData\Roaming\Runing\Runing.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
          PID:2608
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          #cmd
          3⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE

      Filesize

      2.6MB

      MD5

      7820977c8b4d71e342f1a9500c1c631d

      SHA1

      d7e474fbe898efce9d91fa0efe8d9c5819377ad8

      SHA256

      b7a375b496836bdb609b2ad063a8909dd3f35e045a6e75f951d3d7f5d224c945

      SHA512

      ec4060c357f2b690b93ae27e6b9662cb50ee4149964418d6fb957fc9f613909cc01fe50a133d737057ff540335dd6979f2cef383df534fef07c60ba0b2d10713

    • C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

      Filesize

      79KB

      MD5

      a19ec34df640568c43c292a89c383ee1

      SHA1

      23753f88ff613085e363fed6246a3b08a78bf1df

      SHA256

      9b4298ad3fef1f609e9c34fa9471fc2b76bd6f5542823b66ace638b8c2edb079

      SHA512

      735f633aa99b70b486b895421841c5b7dd88e475e8c7e120d9b4054fad0989a23c61c13519a10fca9b575ec92949f7475065af34983606f4ba551e82b76e3f91

    • C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE

      Filesize

      79KB

      MD5

      fa838d62246223fa79f7a7358691584c

      SHA1

      23d6f3ae392937a6c28d2159cc816dc5ee96d82a

      SHA256

      24e0ae5106103bb66889229dd18b796f4923727093113ca289c7039189bda19c

      SHA512

      b9a2ad7eb1f415f492e68fab97b302cd56e6ac1f0f4523a46078b8fbd5d22ac2178b9d5968a0abe9fb3855ac33ef26421b760dbdfb962343cbd291fa6a2a4b8c

    • C:\Users\Admin\AppData\Local\Temp\RUNING.EXE

      Filesize

      189KB

      MD5

      31c7b3f88bae3c9072ceb9c78cef1281

      SHA1

      43a5bd5efc6d7d91ccd41041f4532ad7813c5a57

      SHA256

      9dd3d01dc695d1e89ee6b31df506edb50d986bfae0f9082f945d0d802901cc24

      SHA512

      a9273ef41c7f4677bd6c2d328bd47cc57219eb36c04d96acc10c4da16d3525183fe2ba08ff91a7067a50d8be5623240ca3d09fc645576b4b1dedd16277ebadf9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      9e3fdfd76b8cbf124c0b5a8f210fabf8

      SHA1

      036d142d3eb06e6a1ff1bbca34d48cad3c973f7b

      SHA256

      c1fa04bd121a20d78571a52709fb4b65a8bbaa0a56dad2a613db0730c5c368da

      SHA512

      a216742d84ec80688ba049025c62c95f8c61842688e4bc1a8b06d45515a4c6fec639877849a46e3b9b6871518079b693d4b6d958cc7dfff1936779832ad982cd

    • memory/1652-29-0x00000000002B0000-0x00000000002CA000-memory.dmp

      Filesize

      104KB

    • memory/1676-106-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1676-110-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/1676-108-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1676-114-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1676-104-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1676-112-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1676-111-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-41-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-37-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-47-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-46-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-39-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1896-44-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1896-35-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1916-33-0x0000000000680000-0x00000000006BA000-memory.dmp

      Filesize

      232KB

    • memory/1916-31-0x0000000000880000-0x0000000000B1E000-memory.dmp

      Filesize

      2.6MB

    • memory/2544-92-0x0000000000260000-0x000000000026A000-memory.dmp

      Filesize

      40KB

    • memory/2544-76-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-79-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-80-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-82-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-88-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-90-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2544-85-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2732-57-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-60-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-61-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-62-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2732-51-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-53-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2732-55-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-67-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-69-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-72-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-73-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-75-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2788-65-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/2940-30-0x0000000000020000-0x000000000003A000-memory.dmp

      Filesize

      104KB

    • memory/3052-28-0x00000000009B0000-0x00000000009E6000-memory.dmp

      Filesize

      216KB