Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
04-02-2025 10:05
General
-
Target
AMIRA GENERAL TRADING WHOLESALERS-20250204-100384063200005.exe
-
Size
653KB
-
MD5
a50c7117de5b0903997f17e7e0fb578a
-
SHA1
7fd5ed6db6d3c00eaf5f2aac9f19226bb92950e1
-
SHA256
a00800376b138d0630d4d85572f46e64919750371c670aa677e80af318711ba1
-
SHA512
203728b58c83c153e54a45376040eb039f89b6d6560a9315ba8d12244761d3b45d9db72ceb95345a623f40222436507ec0b3459057180d86a58186bd812ca844
-
SSDEEP
12288:AlfGzZ+AqL9cAVdtYuDF2KHmQVuGiIA1WXZL0CeEEjQp8GfLi2YgJ:AlfGzAVBcYjDF2KG0xi1WpL07Elp/LIO
Malware Config
Extracted
asyncrat
0.5.7B
Default
109.248.151.171:63393
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AMIRA GENERAL TRADING WHOLESALERS-20250204-100384063200005.exe"C:\Users\Admin\AppData\Local\Temp\AMIRA GENERAL TRADING WHOLESALERS-20250204-100384063200005.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AMIRA GENERAL TRADING WHOLESALERS-20250204-100384063200005.exe"C:\Users\Admin\AppData\Local\Temp\AMIRA GENERAL TRADING WHOLESALERS-20250204-100384063200005.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
653KB
MD5a50c7117de5b0903997f17e7e0fb578a
SHA17fd5ed6db6d3c00eaf5f2aac9f19226bb92950e1
SHA256a00800376b138d0630d4d85572f46e64919750371c670aa677e80af318711ba1
SHA512203728b58c83c153e54a45376040eb039f89b6d6560a9315ba8d12244761d3b45d9db72ceb95345a623f40222436507ec0b3459057180d86a58186bd812ca844
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
-
Filesize
72KB
-
Filesize
18.3MB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
45.0MB
-
Filesize
624KB
-
Filesize
18.3MB
-
Filesize
45.0MB
-
Filesize
45.0MB
-
Filesize
45.0MB
-
Filesize
45.0MB
-
Filesize
1.1MB
-
Filesize
45.0MB
-
Filesize
4KB