Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 23:22

General

  • Target

    JaffaCakes118_e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71.exe

  • Size

    72KB

  • MD5

    36d24132150e820598e182d2f51b35b6

  • SHA1

    a1773014c2f0ac1dafc87f3e8d6cd2f697417eae

  • SHA256

    e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71

  • SHA512

    f6da08a584e74bdc2f9f7ea611fc49cfacc8bea3e301c86b53d8c0354028e245b6d9f0149a98207023fcbb9b5561f177e6835e16dfbb2f3d6a343569c0440350

  • SSDEEP

    768:YoBLMxx0Fs4G7WHNw13wRCn1OCDyjb5gr3ir/u2lj4/aJClZl2tYcFmVc6Ka:YoBLMxmcAUVebWrSrGsgPrlKmVcla

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

tytfuzulyxhydjlicv

Attributes
  • delay

    8

  • install

    true

  • install_file

    expanda.exe

  • install_folder

    %AppData%

aes.plain
1
YgG6q3ZTCMt5fYyyJN4cHnHEOYfmBm0U

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn JaffaCakes118_e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71 /tr '"C:\Users\Admin\AppData\Roaming\expanda.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /ru system /rl highest /tn JaffaCakes118_e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71 /tr '"C:\Users\Admin\AppData\Roaming\expanda.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2792
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp82D6.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2848
      • C:\Users\Admin\AppData\Roaming\expanda.exe
        "C:\Users\Admin\AppData\Roaming\expanda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2696

Network

  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    milla.publicvm.com
    expanda.exe
    Remote address:
    8.8.8.8:53
    Request
    milla.publicvm.com
    IN A
No results found
  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    192 B
    192 B
    3
    3

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    192 B
    192 B
    3
    3

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    192 B
    192 B
    3
    3

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    256 B
    4
    4

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53
    milla.publicvm.com
    dns
    expanda.exe
    256 B
    192 B
    4
    3

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

    DNS Request

    milla.publicvm.com

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp82D6.tmp.bat

    Filesize

    151B

    MD5

    dcda45b749a5ed8926a371bf099059c9

    SHA1

    e91b0a27a62a230fe1a869237e11f7d693e65455

    SHA256

    671ff93434cb38a40d695c1bca638635e181e85521fa8a0becded37656acc063

    SHA512

    5c5e54b6234ca9557ec5c0b5d9702bc946cfe315620eb46534b14267f27f817542f714c9ae5658af478f99a8c57820c078a8a61c6ba4c914db0c1b9151cdf756

  • C:\Users\Admin\AppData\Roaming\expanda.exe

    Filesize

    72KB

    MD5

    36d24132150e820598e182d2f51b35b6

    SHA1

    a1773014c2f0ac1dafc87f3e8d6cd2f697417eae

    SHA256

    e8ba9a4744b38798138c8360fa0c892169f128658ae80e9cf229e34c2a683a71

    SHA512

    f6da08a584e74bdc2f9f7ea611fc49cfacc8bea3e301c86b53d8c0354028e245b6d9f0149a98207023fcbb9b5561f177e6835e16dfbb2f3d6a343569c0440350

  • memory/2696-16-0x0000000001330000-0x0000000001342000-memory.dmp

    Filesize

    72KB

  • memory/2884-0-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

    Filesize

    4KB

  • memory/2884-1-0x0000000001130000-0x0000000001142000-memory.dmp

    Filesize

    72KB

  • memory/2884-2-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

    Filesize

    9.9MB

  • memory/2884-12-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

    Filesize

    9.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.