Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2024, 20:51 UTC

General

  • Target

    38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe

  • Size

    694KB

  • MD5

    32c67f99f3c95ba5e1816ca208f9b723

  • SHA1

    c1e29ecea3c87d671448b9dbcc8d8c67b0d14b7e

  • SHA256

    38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7

  • SHA512

    578526bda2f08948475726f36bf247aabeb8f3941f95153d6786bc0db6e43bad44502ef1757bae2bb7c6f6bd0a4bd51e9b33ae363be293b75f490a26c03795f8

  • SSDEEP

    12288:btoKggb2iNdvpc++pd1yIBbrk4ct0gdK/5SVns2M2TgN/0s:5oKgK1XpSpGIZn9+YSVsggi

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

37.0.14.198:6161

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    .exe

  • install_folder

    %AppData%

aes.plain
1
7cZb2K9l1fVDH41Tzlj0nQ0y6RuWOolR

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe
    "C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxBIuIS.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3920
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nxBIuIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp28E0.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1536
    • C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe
      "C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\.exe"' & exit
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\.exe"'
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2600
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D23.tmp.bat""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2164
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:3764
        • C:\Users\Admin\AppData\Roaming\.exe
          "C:\Users\Admin\AppData\Roaming\.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3248
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxBIuIS.exe"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2064
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nxBIuIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3360
          • C:\Users\Admin\AppData\Roaming\.exe
            "C:\Users\Admin\AppData\Roaming\.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1860

Network

  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    74.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    180.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 37.0.14.198:6161
    .exe
    260 B
    5
  • 37.0.14.198:6161
    .exe
    260 B
    5
  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    74.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    74.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
    145 B
    1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    180.129.81.91.in-addr.arpa
    dns
    72 B
    147 B
    1
    1

    DNS Request

    180.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe.log

    Filesize

    1KB

    MD5

    e08f822522c617a40840c62e4b0fb45e

    SHA1

    ae516dca4da5234be6676d3f234c19ec55725be7

    SHA256

    bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7

    SHA512

    894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    d0e93b37e0ce6e5c761bb8896495de85

    SHA1

    a46341b42c3755e9faed4d9ea3af7854140b6a2f

    SHA256

    e92b5d3912f4d447447e94dc41a4a150acfab6132569af1dfa07d51bea02c25c

    SHA512

    3b8d3d97e849a061c9196c79439baaca62637c95e8e78d5e26c3a79cb6a3d14d5f5c8144d990a24feb0bdeabaad64842fe8a64d0ba3e1062e03955c98966988a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scodthbr.ri1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp28E0.tmp

    Filesize

    1KB

    MD5

    ecf0b0aa64d972cfa4c030ad355ea339

    SHA1

    cb199c224fefa5526020f98b9fc253e0e3567138

    SHA256

    2faaa0aadbc36c632e31dccdab6c1f4ec8df455f6891fd6008d578e2508e8700

    SHA512

    c7383bab30015ac4a465b06ae25209d8bbffd0aafd206767e93630454842c7f6259341e7e5b1177c6964556bb2f16f75dbe00df71fde6fb4a84295f37df66dc8

  • C:\Users\Admin\AppData\Local\Temp\tmp3D23.tmp.bat

    Filesize

    144B

    MD5

    f0b2e473a7d6fad525dd07aa91ffd8c4

    SHA1

    9748003bfa14f5f8cbe84125da9eae7557e16881

    SHA256

    0b7292c0b487d4df61a2b486ca1f7b636f20579d0cc48f8efc50a0f51e0cd5e7

    SHA512

    3312ff6e73b21587f36ddd3a0a64cc6db51ccd63854fda596230aac6546dc8ff17fb8d0643439d5ace44678a23efcf1ac0c4d477cf2321b8c5d64014a8bca217

  • C:\Users\Admin\AppData\Roaming\.exe

    Filesize

    694KB

    MD5

    32c67f99f3c95ba5e1816ca208f9b723

    SHA1

    c1e29ecea3c87d671448b9dbcc8d8c67b0d14b7e

    SHA256

    38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7

    SHA512

    578526bda2f08948475726f36bf247aabeb8f3941f95153d6786bc0db6e43bad44502ef1757bae2bb7c6f6bd0a4bd51e9b33ae363be293b75f490a26c03795f8

  • memory/736-10-0x0000000006960000-0x00000000069B4000-memory.dmp

    Filesize

    336KB

  • memory/736-6-0x00000000066E0000-0x0000000006704000-memory.dmp

    Filesize

    144KB

  • memory/736-9-0x0000000006820000-0x000000000682C000-memory.dmp

    Filesize

    48KB

  • memory/736-7-0x000000007534E000-0x000000007534F000-memory.dmp

    Filesize

    4KB

  • memory/736-11-0x0000000006A60000-0x0000000006AFC000-memory.dmp

    Filesize

    624KB

  • memory/736-15-0x0000000006B00000-0x0000000006B66000-memory.dmp

    Filesize

    408KB

  • memory/736-0-0x000000007534E000-0x000000007534F000-memory.dmp

    Filesize

    4KB

  • memory/736-8-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/736-39-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/736-5-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/736-4-0x0000000004D10000-0x0000000004D1A000-memory.dmp

    Filesize

    40KB

  • memory/736-23-0x0000000006350000-0x0000000006364000-memory.dmp

    Filesize

    80KB

  • memory/736-3-0x0000000004C70000-0x0000000004D02000-memory.dmp

    Filesize

    584KB

  • memory/736-2-0x00000000052E0000-0x0000000005884000-memory.dmp

    Filesize

    5.6MB

  • memory/736-1-0x00000000001C0000-0x0000000000274000-memory.dmp

    Filesize

    720KB

  • memory/2064-104-0x0000000007E30000-0x0000000007E41000-memory.dmp

    Filesize

    68KB

  • memory/2064-88-0x0000000006450000-0x00000000067A4000-memory.dmp

    Filesize

    3.3MB

  • memory/2064-93-0x00000000069B0000-0x00000000069FC000-memory.dmp

    Filesize

    304KB

  • memory/2064-94-0x0000000075C20000-0x0000000075C6C000-memory.dmp

    Filesize

    304KB

  • memory/3180-30-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3180-41-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3180-71-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-17-0x0000000002CB0000-0x0000000002CE6000-memory.dmp

    Filesize

    216KB

  • memory/3920-43-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

    Filesize

    200KB

  • memory/3920-44-0x0000000075BD0000-0x0000000075C1C000-memory.dmp

    Filesize

    304KB

  • memory/3920-54-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

    Filesize

    120KB

  • memory/3920-55-0x00000000077C0000-0x0000000007863000-memory.dmp

    Filesize

    652KB

  • memory/3920-56-0x0000000007F40000-0x00000000085BA000-memory.dmp

    Filesize

    6.5MB

  • memory/3920-57-0x0000000007900000-0x000000000791A000-memory.dmp

    Filesize

    104KB

  • memory/3920-58-0x0000000007970000-0x000000000797A000-memory.dmp

    Filesize

    40KB

  • memory/3920-59-0x0000000007B80000-0x0000000007C16000-memory.dmp

    Filesize

    600KB

  • memory/3920-60-0x0000000007B00000-0x0000000007B11000-memory.dmp

    Filesize

    68KB

  • memory/3920-61-0x0000000007B30000-0x0000000007B3E000-memory.dmp

    Filesize

    56KB

  • memory/3920-62-0x0000000007B40000-0x0000000007B54000-memory.dmp

    Filesize

    80KB

  • memory/3920-63-0x0000000007C40000-0x0000000007C5A000-memory.dmp

    Filesize

    104KB

  • memory/3920-64-0x0000000007C20000-0x0000000007C28000-memory.dmp

    Filesize

    32KB

  • memory/3920-70-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-42-0x00000000066C0000-0x000000000670C000-memory.dmp

    Filesize

    304KB

  • memory/3920-40-0x00000000065D0000-0x00000000065EE000-memory.dmp

    Filesize

    120KB

  • memory/3920-37-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-36-0x0000000006090000-0x00000000063E4000-memory.dmp

    Filesize

    3.3MB

  • memory/3920-22-0x00000000055A0000-0x0000000005606000-memory.dmp

    Filesize

    408KB

  • memory/3920-24-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-21-0x0000000005500000-0x0000000005522000-memory.dmp

    Filesize

    136KB

  • memory/3920-19-0x0000000005960000-0x0000000005F88000-memory.dmp

    Filesize

    6.2MB

  • memory/3920-18-0x0000000075340000-0x0000000075AF0000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.