Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2025 16:39
Behavioral task
behavioral1
Sample
Stub.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Stub.exe
-
Size
38KB
-
MD5
f76702fa423ce2b2b4b0fdcf547b0789
-
SHA1
ea408a4419e8a3139ef14df987608964c12d3190
-
SHA256
0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e
-
SHA512
03c7d8814687bb4f11ac41a555f368d89d5be749c92624073b77da0e57d872df201f2657b180ad0c9d5bc9ffa0a85989bf31374c7e5deefa06cf36bce3697971
-
SSDEEP
768:9Xaug0LrCc4d7VtOjkR26/XgNhKwEuyj67zACVyI1rXDjkY5Z07:dafSuVtOGfgTKwt3Nk7
Malware Config
Signatures
-
Asyncrat family
-
Program crash 1 IoCs
pid pid_target Process procid_target 3144 828 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stub.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4536 taskmgr.exe Token: SeSystemProfilePrivilege 4536 taskmgr.exe Token: SeCreateGlobalPrivilege 4536 taskmgr.exe Token: 33 4536 taskmgr.exe Token: SeIncBasePriorityPrivilege 4536 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe 4536 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 7442⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 828 -ip 8281⤵PID:1404
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4536