Analysis
-
max time kernel
175s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 10:25
General
-
Target
Sonoyuncu client tr v1.0.0.exe
-
Size
253KB
-
MD5
006cf9ecda1c06de525937b3177217cb
-
SHA1
b997841645e4194e79ba65a138052c6d31ef901b
-
SHA256
c93e91208da32c2d53feb734663f4260494d016f9e505551449105e91e85bb09
-
SHA512
33dfffcb3d706b810883d757e79430ce8998acb4bf9c0a7d78486517a5375527a3fa83d8605ff228f7ca38349114330301e89b99e68d73a9558ecace34fe6575
-
SSDEEP
3072:Lu/aTUP/2ufHNbx2lUkNcy/pq3canAwKcVkMfHlgCkh:Lu/hOYtbEUkP/pq3c+AjcVlfFDG
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sonoyuncu client tr v1.0.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sonoyuncu client tr v1.0.0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings taskmgr.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2280 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4628 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4628 taskmgr.exe Token: SeSystemProfilePrivilege 4628 taskmgr.exe Token: SeCreateGlobalPrivilege 4628 taskmgr.exe Token: SeBackupPrivilege 3232 svchost.exe Token: SeRestorePrivilege 3232 svchost.exe Token: SeSecurityPrivilege 3232 svchost.exe Token: SeTakeOwnershipPrivilege 3232 svchost.exe Token: 35 3232 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe 4628 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sonoyuncu client tr v1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\Sonoyuncu client tr v1.0.0.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1408
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4628
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\Sonoyuncu client tr v1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\Sonoyuncu client tr v1.0.0.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3232
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wmsetup.log1⤵
- Opens file in notepad (likely ransom note)
PID:2280