Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 03:36

General

  • Target

    d00d857b3d2b02c4ae31f5f31e22ab8e98d2c54b65dd68c994300985f20535b6.exe

  • Size

    10.4MB

  • MD5

    1709ac76cf759864bda829f2db77fb9c

  • SHA1

    763937dfaae0ee35b010ba987c1e02264a3a801c

  • SHA256

    d00d857b3d2b02c4ae31f5f31e22ab8e98d2c54b65dd68c994300985f20535b6

  • SHA512

    3064b5dd6147e872bcf409140a16ee7a35ea1b0663fb0fce88901b18474d02a1d24a333e798be09027fc35e29510563b458352d74d47550b6de567fcb123c134

  • SSDEEP

    6144:SUm07J7ezm3f3C8QS4syOpj5PZOpRfXnhKhaQpYGO3Cfg+:O0cwPC8OsymVeR/h2a01E3

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

87.120.125.185:6606

Mutex

BI0OVzXXg6YF

Attributes
  • delay

    3

  • install

    false

  • install_file

    rokas.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\d00d857b3d2b02c4ae31f5f31e22ab8e98d2c54b65dd68c994300985f20535b6.exe
      "C:\Users\Admin\AppData\Local\Temp\d00d857b3d2b02c4ae31f5f31e22ab8e98d2c54b65dd68c994300985f20535b6.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\UserApp_Debug.log

    Filesize

    228B

    MD5

    bbcc61ae248085d4e39d1a5af5d64af7

    SHA1

    1025b5066f92db1850c6f46a2565647c7ff2283f

    SHA256

    0ecc65b2aa64d5930248aa5e955181c312d917c113d135415ecb60f3f11c4766

    SHA512

    715eb19056bbf7d830465e294018d0af776247db36137cb48036a499b713c7040ecee40e1bfa2a979ae779ca1f0d7e3bb014c7ef63ce35a03e44d4ba8359be74

  • memory/3456-11-0x0000000002C40000-0x0000000002C53000-memory.dmp

    Filesize

    76KB

  • memory/3456-13-0x00007FFEE6553000-0x00007FFEE6555000-memory.dmp

    Filesize

    8KB

  • memory/3456-14-0x00000000074A0000-0x00000000074B2000-memory.dmp

    Filesize

    72KB

  • memory/3456-15-0x00007FFEE6550000-0x00007FFEE7011000-memory.dmp

    Filesize

    10.8MB

  • memory/3456-18-0x00007FFEE6553000-0x00007FFEE6555000-memory.dmp

    Filesize

    8KB

  • memory/3456-19-0x00007FFEE6550000-0x00007FFEE7011000-memory.dmp

    Filesize

    10.8MB

  • memory/3456-20-0x00007FFEE6550000-0x00007FFEE7011000-memory.dmp

    Filesize

    10.8MB

  • memory/3456-21-0x00007FFEE6550000-0x00007FFEE7011000-memory.dmp

    Filesize

    10.8MB