Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
07/11/2025, 05:17
General
- Target 2025-11-07_bbf5552056cc6629f69c81cad9c33130_elex_wannacry.exe
- Size 8.8MB
- Sample251107-fy2mbs1lgr
- SHA256 ae5b1853a93a2d9c46ab423aa90f650b8f4a2f2edb94a92848800c0c8c9b7543
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\usrexecutor
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Extracted
-
asyncrat
-
| CRACKED BY https://t.me/xworm_v2
-
Default
-
ansy20225.dynuddns.net:2107
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- Async RAT payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 27 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-11-07_bbf5552056cc6629f69c81cad9c33130_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-11-07_bbf5552056cc6629f69c81cad9c33130_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AurProcessor.exe"C:\Users\Admin\AppData\Local\Temp\AurProcessor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\usrexecutor\AurProcessor.exeC:\ProgramData\usrexecutor\AurProcessor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\CircuitTrack.exeC:\Users\Admin\CircuitTrack.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\usrexecutor\Chime.exeC:\Users\Admin\AppData\Roaming\usrexecutor\Chime.exe4⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3C6B018.tmp
77D8D5B.tmp
77D8D5B.tmp
AurProcessor.exe
Kleen.ya
MSVCP110.dll
MSVCR110.dll
Shuckoock.dd
VCOMP110.DLL
Zxl.dll
ippcc-7.0.dll
ippccg9-7.0.dll
ippcore-7.0.dll
ippi-7.0.dll
ippig9-7.0.dll
libiomp5md.dll
zcl.dll
zpsres.US.dll
Chime.exe
CircuitTrack.exe
memory/2728-109-0x0000000000E50000-0x0000000000EB4000-memory.dmp
memory/2728-112-0x0000000000EC0000-0x0000000000F7E000-memory.dmp
memory/2728-113-0x0000000000F80000-0x0000000000FA0000-memory.dmp
memory/2728-118-0x0000000073240000-0x0000000073330000-memory.dmp
memory/2728-119-0x00007FFE942C0000-0x00007FFE944C9000-memory.dmp
memory/2728-121-0x0000000073240000-0x0000000073330000-memory.dmp
memory/2728-125-0x0000000073240000-0x0000000073330000-memory.dmp
memory/2728-133-0x0000000000440000-0x000000000044A000-memory.dmp
memory/4104-149-0x0000000073240000-0x0000000073330000-memory.dmp
memory/4104-148-0x00007FFE942C0000-0x00007FFE944C9000-memory.dmp
memory/4360-132-0x00007FFE942C0000-0x00007FFE944C9000-memory.dmp
memory/4360-134-0x0000000000500000-0x000000000053B000-memory.dmp
memory/4360-137-0x0000000003100000-0x0000000003116000-memory.dmp
memory/4360-139-0x0000000000500000-0x000000000053B000-memory.dmp
memory/4360-142-0x0000000000500000-0x000000000053B000-memory.dmp
memory/4360-127-0x0000000000500000-0x000000000053B000-memory.dmp
memory/5584-59-0x00000000011E0000-0x0000000001244000-memory.dmp
memory/5584-56-0x00000000011C0000-0x00000000011E0000-memory.dmp
memory/5584-66-0x0000000071F20000-0x0000000072010000-memory.dmp
memory/5584-62-0x0000000001250000-0x000000000130E000-memory.dmp
memory/5584-67-0x00007FFE942C0000-0x00007FFE944C9000-memory.dmp