Analysis

  • max time kernel
    62s
  • max time network
    65s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-01-2025 23:58

General

  • Target

    NVIDIA GeForce Experience.exe

  • Size

    515KB

  • MD5

    96ef75b619c48477b1aff625f4aadd58

  • SHA1

    c869edf72ef6cf1c4412f0c4d98891b3c66483c9

  • SHA256

    abf8c0425e1f9fcda7ad276bf1bef3ed6c809f18566aa615b81c5cb7940bb025

  • SHA512

    9835d256ffa1632f2a8f3b7f902a0b8e1c6dbcfd51e69dfa6ce7b9f6965e8cb760a2824749ff80c1845c9703506c8a40e780659418955193097ada97ff328197

  • SSDEEP

    3072:1qXibN8kmKuHUYF2drg2Ab4aUzwtszjJY:AXm7/RXAb9Uz9i

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Testing

C2

AnonymousUser222222222222-49972.portmap.host:49972

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    NVIDIA.exe

  • install_folder

    %AppData%

aes.plain
1
HmHMYlO7L7LR7CLpfbIAVpcxRWFvECBq

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NVIDIA GeForce Experience.exe
    "C:\Users\Admin\AppData\Local\Temp\NVIDIA GeForce Experience.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "NVIDIA" /tr '"C:\Users\Admin\AppData\Roaming\NVIDIA.exe"' & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "NVIDIA" /tr '"C:\Users\Admin\AppData\Roaming\NVIDIA.exe"'
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4892
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8ADB.tmp.bat""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:4740
      • C:\Users\Admin\AppData\Roaming\NVIDIA.exe
        "C:\Users\Admin\AppData\Roaming\NVIDIA.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3020

Network

  • flag-us
    DNS
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    Remote address:
    8.8.8.8:53
    Request
    AnonymousUser222222222222-49972.portmap.host
    IN A
    Response
    AnonymousUser222222222222-49972.portmap.host
    IN A
    193.161.193.99
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    NVIDIA.exe
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    160 B
    5
    4
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 193.161.193.99:49972
    AnonymousUser222222222222-49972.portmap.host
    NVIDIA.exe
    260 B
    200 B
    5
    5
  • 8.8.8.8:53
    AnonymousUser222222222222-49972.portmap.host
    dns
    NVIDIA.exe
    156 B
    196 B
    2
    2

    DNS Request

    AnonymousUser222222222222-49972.portmap.host

    DNS Response

    193.161.193.99

    DNS Request

    8.8.8.8.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp8ADB.tmp.bat

    Filesize

    150B

    MD5

    77d36f45123df41d2a83c9e983d264b9

    SHA1

    5bfa2e9b61e02b2b9ef81a0a9ba50165b051d6c8

    SHA256

    fa9b01fe487979fed64951769832236463c321743ed301ff7ed537e870aac184

    SHA512

    de57d9d32bac373b286f882aed8d5662ed44a9d123d532990408f53a57f096636ce526feab71573ead416ef0cb98a8d3a472342a4a7ed9795ad9fa7bcf35424b

  • C:\Users\Admin\AppData\Roaming\NVIDIA.exe

    Filesize

    515KB

    MD5

    96ef75b619c48477b1aff625f4aadd58

    SHA1

    c869edf72ef6cf1c4412f0c4d98891b3c66483c9

    SHA256

    abf8c0425e1f9fcda7ad276bf1bef3ed6c809f18566aa615b81c5cb7940bb025

    SHA512

    9835d256ffa1632f2a8f3b7f902a0b8e1c6dbcfd51e69dfa6ce7b9f6965e8cb760a2824749ff80c1845c9703506c8a40e780659418955193097ada97ff328197

  • memory/3020-15-0x00000000747B0000-0x0000000074F61000-memory.dmp

    Filesize

    7.7MB

  • memory/3020-20-0x00000000747B0000-0x0000000074F61000-memory.dmp

    Filesize

    7.7MB

  • memory/3020-19-0x00000000747B0000-0x0000000074F61000-memory.dmp

    Filesize

    7.7MB

  • memory/3020-18-0x0000000005C60000-0x0000000005C6A000-memory.dmp

    Filesize

    40KB

  • memory/3020-17-0x0000000005C90000-0x0000000005D22000-memory.dmp

    Filesize

    584KB

  • memory/3020-16-0x0000000005F60000-0x0000000006506000-memory.dmp

    Filesize

    5.6MB

  • memory/3020-14-0x00000000747B0000-0x0000000074F61000-memory.dmp

    Filesize

    7.7MB

  • memory/4104-3-0x0000000004FD0000-0x0000000005036000-memory.dmp

    Filesize

    408KB

  • memory/4104-10-0x0000000074850000-0x0000000075001000-memory.dmp

    Filesize

    7.7MB

  • memory/4104-4-0x00000000053E0000-0x000000000547C000-memory.dmp

    Filesize

    624KB

  • memory/4104-0-0x000000007485E000-0x000000007485F000-memory.dmp

    Filesize

    4KB

  • memory/4104-2-0x0000000074850000-0x0000000075001000-memory.dmp

    Filesize

    7.7MB

  • memory/4104-1-0x0000000000470000-0x00000000004F6000-memory.dmp

    Filesize

    536KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.