Overview
overview
10Static
static
103c7b097b31...0f.exe
windows7-x64
83c7b097b31...0f.exe
windows10-2004-x64
83c8a6c6cde...86.exe
windows7-x64
103c8a6c6cde...86.exe
windows10-2004-x64
103ca3e4676b...f1.exe
windows7-x64
103ca3e4676b...f1.exe
windows10-2004-x64
103cb47c4bbe...c1.exe
windows7-x64
103cb47c4bbe...c1.exe
windows10-2004-x64
103d18edb3bf...ff.exe
windows7-x64
13d18edb3bf...ff.exe
windows10-2004-x64
3d1ee6caf0...b4.exe
windows7-x64
103d1ee6caf0...b4.exe
windows10-2004-x64
103d2f05086d...0c.exe
windows7-x64
103d2f05086d...0c.exe
windows10-2004-x64
103d81f411b0...ba.exe
windows7-x64
103d81f411b0...ba.exe
windows10-2004-x64
103d90976d58...8c.exe
windows7-x64
103d90976d58...8c.exe
windows10-2004-x64
103d97ea72c5...9e.exe
windows7-x64
103d97ea72c5...9e.exe
windows10-2004-x64
103dd452b939...18.exe
windows7-x64
33dd452b939...18.exe
windows10-2004-x64
33dfc71cfc4...bd.exe
windows7-x64
103dfc71cfc4...bd.exe
windows10-2004-x64
103e435c9ff2...57.exe
windows7-x64
103e435c9ff2...57.exe
windows10-2004-x64
103e624f48a8...2b.exe
windows7-x64
13e624f48a8...2b.exe
windows10-2004-x64
43e8acfab95...cc.exe
windows7-x64
103e8acfab95...cc.exe
windows10-2004-x64
103e9a136b97...9d.exe
windows7-x64
103e9a136b97...9d.exe
windows10-2004-x64
10Analysis
-
max time kernel
151s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral27
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win10v2004-20250314-en
General
-
Target
3e9a136b97b7ad7104019ae696b4f59d.exe
-
Size
273KB
-
MD5
3e9a136b97b7ad7104019ae696b4f59d
-
SHA1
99fff6e4e8320f9908ee359a3ed05549ef4d03a9
-
SHA256
ab3e7a2f39d9f97249371e3e0710bc1878410d19d8709fe5d9db437df1904a11
-
SHA512
8fab1f6ae6d36ddd4e92443064ac2473e5cc6a5db9cbf28d6446ecbc1836860bbc0afe78f7b49db3bd8dedb5b4043da49c996156107d2c2433ec999c37527ea4
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdT6:WFzDqa86hV6uRRqX1evPlwAEdO
Malware Config
Extracted
asyncrat
0.4.9G
corporation.warzonedns.com:9341
480-28105c055659
-
delay
0
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral31/memory/2784-37-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral31/memory/2784-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral31/memory/2784-38-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral31/memory/2784-33-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral31/memory/2784-31-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
pid Process 2952 HiPatchService.exe -
Loads dropped DLL 1 IoCs
pid Process 2608 3e9a136b97b7ad7104019ae696b4f59d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 3e9a136b97b7ad7104019ae696b4f59d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2952 set thread context of 2784 2952 HiPatchService.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e9a136b97b7ad7104019ae696b4f59d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HiPatchService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe 2784 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2952 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 29 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2608 wrote to memory of 2776 2608 3e9a136b97b7ad7104019ae696b4f59d.exe 30 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32 PID 2952 wrote to memory of 2784 2952 HiPatchService.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e9a136b97b7ad7104019ae696b4f59d.exe"C:\Users\Admin\AppData\Local\Temp\3e9a136b97b7ad7104019ae696b4f59d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
273KB
MD56602ae81a5935f7c1b54814422ee0e0d
SHA145e1c958931ade34b996e88aa79c9f61f0933cf5
SHA256052581c67fd1c52a6ad93dc3acef596b99cf915b2801cddb89ad2c9786e6ac34
SHA5124a87dced27a7d1e0e8e50da7083498a990a8278c049017936b68944879037a1cfc55a7acc416606d2dab5aabd8a01357ca8755b0dd122029bc0c37b8f3d1d78f