Analysis
-
max time kernel
54s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2025 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Stub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
300 seconds
General
-
Target
Stub.exe
-
Size
10KB
-
MD5
55cf4bcfb51ec738927ad5f152360de2
-
SHA1
bb763eb4bb84ff5e38c3bb381f81b2665ee257fa
-
SHA256
4bae7d4ff0c2e9a99852a4cc7828ade235abbaed12e125d1b888d79b2b75fe75
-
SHA512
6fb5bde2c2aa950a82993ca208d8544414dff10532de0fcb302bd0014808c4ddd778d58903857125d6627ccaa3586a94622cd0c51c0839879dc5a2fc9ccf40f3
-
SSDEEP
96:u/+JiA0Pcj+plyPocZCoB8d3ZxlH7ZCP2UuKJKJuItZkZtHcDjf2EBVkYlhJpn80:mP3j7oBQZxlbm2LKJKJun7HYgY3nnff
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
GDFjbxc9as
Mutex
Gx0edRwRzsDs0gzwQ
Attributes
-
delay
1
-
install
false
-
install_file
GoogleUpdates.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/QLnQD5yh
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 2 IoCs
resource yara_rule behavioral1/memory/3352-7-0x00000000051A0000-0x00000000051B2000-memory.dmp family_asyncrat behavioral1/memory/2884-28-0x0000000005870000-0x0000000005882000-memory.dmp family_asyncrat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Stub.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Stub.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 15 pastebin.com 16 pastebin.com 34 pastebin.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\shellhost.exe Stub.exe File created C:\Program Files\shellhost.exe Stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2900 3352 WerFault.exe 81 2320 2884 WerFault.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1608 schtasks.exe 3756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 64 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3352 Stub.exe Token: SeDebugPrivilege 64 taskmgr.exe Token: SeSystemProfilePrivilege 64 taskmgr.exe Token: SeCreateGlobalPrivilege 64 taskmgr.exe Token: SeDebugPrivilege 2884 Stub.exe Token: 33 64 taskmgr.exe Token: SeIncBasePriorityPrivilege 64 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe 64 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3352 wrote to memory of 1608 3352 Stub.exe 83 PID 3352 wrote to memory of 1608 3352 Stub.exe 83 PID 3352 wrote to memory of 1608 3352 Stub.exe 83 PID 2884 wrote to memory of 3756 2884 Stub.exe 106 PID 2884 wrote to memory of 3756 2884 Stub.exe 106 PID 2884 wrote to memory of 3756 2884 Stub.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc onstart /tn "shellhost" /tr "C:\Program Files\shellhost.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 21922⤵
- Program crash
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3352 -ip 33521⤵PID:464
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:64
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc onstart /tn "shellhost" /tr "C:\Program Files\shellhost.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 21642⤵
- Program crash
PID:2320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2884 -ip 28841⤵PID:1932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD555cf4bcfb51ec738927ad5f152360de2
SHA1bb763eb4bb84ff5e38c3bb381f81b2665ee257fa
SHA2564bae7d4ff0c2e9a99852a4cc7828ade235abbaed12e125d1b888d79b2b75fe75
SHA5126fb5bde2c2aa950a82993ca208d8544414dff10532de0fcb302bd0014808c4ddd778d58903857125d6627ccaa3586a94622cd0c51c0839879dc5a2fc9ccf40f3