Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 21:46
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
Errors
General
-
Target
Client.exe
-
Size
48KB
-
MD5
c455e1785b15f7ab254cfc3418803921
-
SHA1
9164b636c9e11d1060009de5100a6b60e5f37837
-
SHA256
7d7fefea4821294e42f1848ec0d0512398d53d75fad6130cf7d47384378d7bca
-
SHA512
0b3acca31da5d6a477ecf36b4a97d2c2e76fae7b6663024222934304da46043a93ddead5551c402d47d709b89854f8d66b807f3f8d52911be3bfc5e26ef4eb2d
-
SSDEEP
768:AWgtBBILDmY1+Vxi4telDSN+iV08YbygetBrUyvvEgK/JkEVc6KN:ADak84tKDs4zb1wB4yvnkJkEVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
GoogleUpdate.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/rN9BXgA1
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0032000000023b5c-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Client.exe -
Executes dropped EXE 1 IoCs
pid Process 2224 GoogleUpdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 pastebin.com 15 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1128 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 2880 taskkill.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe 3204 Client.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3204 Client.exe Token: SeDebugPrivilege 3204 Client.exe Token: SeDebugPrivilege 2224 GoogleUpdate.exe Token: SeDebugPrivilege 2224 GoogleUpdate.exe Token: SeDebugPrivilege 2880 taskkill.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3204 wrote to memory of 444 3204 Client.exe 83 PID 3204 wrote to memory of 444 3204 Client.exe 83 PID 3204 wrote to memory of 1320 3204 Client.exe 85 PID 3204 wrote to memory of 1320 3204 Client.exe 85 PID 444 wrote to memory of 5084 444 cmd.exe 87 PID 444 wrote to memory of 5084 444 cmd.exe 87 PID 1320 wrote to memory of 1128 1320 cmd.exe 88 PID 1320 wrote to memory of 1128 1320 cmd.exe 88 PID 1320 wrote to memory of 2224 1320 cmd.exe 90 PID 1320 wrote to memory of 2224 1320 cmd.exe 90 PID 2224 wrote to memory of 4688 2224 GoogleUpdate.exe 108 PID 2224 wrote to memory of 4688 2224 GoogleUpdate.exe 108 PID 4688 wrote to memory of 2880 4688 cmd.exe 110 PID 4688 wrote to memory of 2880 4688 cmd.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1128
-
-
C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SYSTEM32\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\taskkill.exetaskkill /f /im svchost.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD55c924f0b8b94db8e8d5aad8a508928cb
SHA1daef15bc78cad0f0ddfe3768126c61486da00f76
SHA25691c3166d19ffa4c5fa0373a6f2cb985a73994c652b4eb0b1a7d39101451cb5f7
SHA512b146430adcf9666625e425a3b3b11d556025b4e5f14131e60de2b6e57855c5f2727e59270b1a67fd934c73d074af06e1fb364e9a827df8e89d9527a8f52caf8d
-
Filesize
48KB
MD5c455e1785b15f7ab254cfc3418803921
SHA19164b636c9e11d1060009de5100a6b60e5f37837
SHA2567d7fefea4821294e42f1848ec0d0512398d53d75fad6130cf7d47384378d7bca
SHA5120b3acca31da5d6a477ecf36b4a97d2c2e76fae7b6663024222934304da46043a93ddead5551c402d47d709b89854f8d66b807f3f8d52911be3bfc5e26ef4eb2d