File name: | b424bfaf84875510e6137d934959d7e8.exe |
Full analysis: | https://app.any.run/tasks/a4cd7bd9-470f-4881-9874-9dc894aef203 |
Verdict: | Malicious activity |
Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
Analysis date: | April 01, 2023, 04:31:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | B424BFAF84875510E6137D934959D7E8 |
SHA1: | 630FD1D0B51B1DC44961C3F27CF12C76F4A2A8EE |
SHA256: | 3CEA3EED68E11A7775D7EE3D3B1F3718127A0926CF3E36DD316B7E56B15F2462 |
SSDEEP: | 49152:HvwlL26AaNeWgPhlmVqvMQ7XSKEeeIBxQ6oGdx0THHB72eh2NTh:HvYL26AaNeWgPhlmVqkQ7XSKpes5 |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
---|---|---|
.exe | | | Win64 Executable (generic) (23.8) |
.dll | | | Win32 Dynamic Link Library (generic) (5.6) |
.exe | | | Win32 Executable (generic) (3.8) |
.exe | | | Generic Win/DOS Executable (1.7) |
AssemblyVersion: | 1.4.1.0 |
---|---|
ProductVersion: | 1.4.1.0 |
ProductName: | Java Update Scheduler |
OriginalFileName: | Java Update Scheduler |
LegalTrademarks: | Oracle |
LegalCopyright: | Oracle |
InternalName: | Java Update Scheduler |
FileVersion: | 1.4.1.0 |
FileDescription: | - |
CompanyName: | Oracle |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.4.1.0 |
FileVersionNumber: | 1.4.1.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x31e42e |
UninitializedDataSize: | - |
InitializedDataSize: | 185344 |
CodeSize: | 3261952 |
LinkerVersion: | 8 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2023:03:12 16:16:39+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 12-Mar-2023 16:16:39 |
Comments: | - |
CompanyName: | Oracle |
FileDescription: | - |
FileVersion: | 1.4.1.0 |
InternalName: | Java Update Scheduler |
LegalCopyright: | Oracle |
LegalTrademarks: | Oracle |
OriginalFilename: | Java Update Scheduler |
ProductName: | Java Update Scheduler |
ProductVersion: | 1.4.1.0 |
Assembly Version: | 1.4.1.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 12-Mar-2023 16:16:39 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00002000 | 0x0031C434 | 0x0031C600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.07784 |
.rsrc | 0x00320000 | 0x0002D0F4 | 0x0002D200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.53623 |
.reloc | 0x0034E000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.18029 | 1751 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 3.52128 | 2440 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 3.29927 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 2.95636 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 2.77411 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 2.68175 | 21640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 2.50572 | 38056 | Latin 1 / Western European | UNKNOWN | RT_ICON |
8 | 2.29806 | 67624 | Latin 1 / Western European | UNKNOWN | RT_ICON |
9 | 7.95341 | 19423 | Latin 1 / Western European | UNKNOWN | RT_ICON |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
680 | "C:\Users\admin\AppData\Local\Temp\b424bfaf84875510e6137d934959d7e8.exe" | C:\Users\admin\AppData\Local\Temp\b424bfaf84875510e6137d934959d7e8.exe | explorer.exe | ||||||||||||
User: admin Company: Oracle Integrity Level: MEDIUM Exit code: 3 Version: 1.4.1.0 Modules
| |||||||||||||||
504 | "C:\Users\admin\AppData\Roaming\Java\Java Scheduler Update.exe" | C:\Users\admin\AppData\Roaming\Java\Java Scheduler Update.exe | b424bfaf84875510e6137d934959d7e8.exe | ||||||||||||
User: admin Company: Oracle Integrity Level: MEDIUM Version: 1.4.1.0 Modules
Quasar(PID) Process(504) Java Scheduler Update.exe CertificateMIIE9DCCAtygAwIBAgIQANCP4cf0H+xTVTZ3rmGMqzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDMyNTA1MDYxMFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApyQJKZJxhYfMWDu22/QOF5BhoR4EW9QkERSV6bieZKrf2QXoyw9MYmPSrHTTeu8JDtuas8kz... SignatureQ2Gd1ywVPBTohyiL2zHVqcsXtdcgLI/S5+Tazctmez7XhDhoOBIJKLbbSd+Aby1zuYyAtuEcoLxqbzznzcqyMkK5rLkeQBsqZpx0jM2p+3rQHJN5BEh+xV4hon51sD5el6wKQRju8mUDZR4wnmvdGW4d+1hMpshSuueagN2OzuMhm4HBekB93cMByIkeTplACRfzwrR9pXrbXncNP2whlQZtf6lEYTU081795loiIRTQ/QZZo+W3u85EmFk71FFmYczhSIbe9u93D7p5nWKtlUwQ3XqvxjmhXhpBH3HI43/V... LogDirLogs TagVPS StartupJava Update Scheduler Event Mutex3868e134-e160-4cb5-8f2d-41a0ebb7f8fb Install_NameJava Scheduler Update.exe Sub_DirJava C2 (2)65.0.50.125:22247 Version1.4.1 | |||||||||||||||
1420 | "C:\Users\admin\AppData\Local\Temp\aug6m3BHjANi.exe" | C:\Users\admin\AppData\Local\Temp\aug6m3BHjANi.exe | Java Scheduler Update.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1884 | C:\Windows\system32\cmd.exe /c 215561680323591.bat | C:\Windows\SysWOW64\cmd.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
992 | cscript //nologo c.vbs | C:\Windows\SysWOW64\cscript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
1160 | !WannaDecryptor!.exe f | C:\Users\admin\AppData\Local\Temp\!WannaDecryptor!.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Sync Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1068 | taskkill /f /im MSExchange* | C:\Windows\SysWOW64\taskkill.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1736 | taskkill /f /im Microsoft.Exchange.* | C:\Windows\SysWOW64\taskkill.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1432 | taskkill /f /im sqlserver.exe | C:\Windows\SysWOW64\taskkill.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1760 | taskkill /f /im sqlwriter.exe | C:\Windows\SysWOW64\taskkill.exe | — | aug6m3BHjANi.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (680) b424bfaf84875510e6137d934959d7e8.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | Java Update Scheduler Event |
Value: "C:\Users\admin\AppData\Roaming\Java\Java Scheduler Update.exe" | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (504) Java Scheduler Update.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1160) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (1160) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: |
PID | Process | Filename | Type | |
---|---|---|---|---|
680 | b424bfaf84875510e6137d934959d7e8.exe | C:\Users\admin\AppData\Roaming\Java\Java Scheduler Update.exe | executable | |
MD5:B424BFAF84875510E6137D934959D7E8 | SHA256:3CEA3EED68E11A7775D7EE3D3B1F3718127A0926CF3E36DD316B7E56B15F2462 | |||
504 | Java Scheduler Update.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:97F96C47B97B3AA5479A94855505B104 | SHA256:E88B43C67E40C48CADF272E9D5D6B8E0360A37A7376419D744A0C2D74D6874A5 | |||
504 | Java Scheduler Update.exe | C:\Users\admin\AppData\Local\Temp\TarC25D.tmp | cat | |
MD5:BE2BEC6E8C5653136D3E72FE53C98AA3 | SHA256:1919AAB2A820642490169BDC4E88BD1189E22F83E7498BF8EBDFB62EC7D843FD | |||
1420 | aug6m3BHjANi.exe | C:\Users\admin\AppData\Local\Temp\m.wry | text | |
MD5:980B08BAC152AFF3F9B0136B616AFFA5 | SHA256:402046ADA270528C9AC38BBFA0152836FE30FB8E12192354E53B8397421430D9 | |||
1420 | aug6m3BHjANi.exe | C:\Users\admin\AppData\Local\Temp\c.wry | abr | |
MD5:663E55DF21852BC8870B86BC38E58262 | SHA256:BF22E8E18DB1638673F47591A13D18EE58D8C6019314BAB5A90BE82AE3DC9538 | |||
1884 | cmd.exe | C:\Users\admin\AppData\Local\Temp\c.vbs | text | |
MD5:2C69421394B3CF1E8531E5BA60824C2F | SHA256:89CDEBC8A19455D87815A80CEE66AE366C3391D6A776F21753248CF2DC857554 | |||
1420 | aug6m3BHjANi.exe | C:\Users\admin\AppData\Local\Temp\00000000.pky | binary | |
MD5:53109FD240048A60E09668BF54A2831D | SHA256:1C24C7C076A370502F500D224E9C4E6B33A99046B30B0D5B1AAAD129A087CB3A | |||
1420 | aug6m3BHjANi.exe | C:\Users\admin\AppData\Local\Temp\00000000.res | binary | |
MD5:5D8D4F38075F2FCE00B2B5D4EAC113C0 | SHA256:A28AB268B1B064EF2A08A3AE92457F4AD14374EF28DB411A3388DE66E315BC8D | |||
992 | cscript.exe | C:\Users\admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk | lnk | |
MD5:966B39A9E35FC6715A40A14012CE2C06 | SHA256:76C17F087D8FC707CBDFC38A1430DCEC11E5EB7E95CCCF04B8B31F6346F67D49 | |||
504 | Java Scheduler Update.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:E71C8443AE0BC2E282C73FAEAD0A6DD3 | SHA256:95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
504 | Java Scheduler Update.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1d9ad4619dd5de81 | US | compressed | 61.1 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
504 | Java Scheduler Update.exe | 195.201.57.90:443 | ipwho.is | Hetzner Online GmbH | DE | suspicious |
504 | Java Scheduler Update.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
504 | Java Scheduler Update.exe | 65.0.50.125:22247 | — | AMAZON-02 | IN | malicious |
Domain | IP | Reputation |
---|---|---|
ctldl.windowsupdate.com |
| whitelisted |
ipwho.is |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
504 | Java Scheduler Update.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Malicious SSL Cert (Quasar CnC) |
504 | Java Scheduler Update.exe | Domain Observed Used for C2 Detected | ET MALWARE Generic AsyncRAT Style SSL Cert |
— | — | Potentially Bad Traffic | ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is) |