Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
02-07-2020 17:42
Static task
static1
Behavioral task
behavioral1
Sample
e2e89b28656886ead31cceb62f78b80b.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
e2e89b28656886ead31cceb62f78b80b.exe
Resource
win10
General
-
Target
e2e89b28656886ead31cceb62f78b80b.exe
-
Size
210KB
-
MD5
e2e89b28656886ead31cceb62f78b80b
-
SHA1
14f78bf703b0a20409f4f20d0241ff1d287963d9
-
SHA256
7fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
-
SHA512
054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84
Malware Config
Extracted
asyncrat
0.5.7B
migracion.linkpc.net:3468
AsyncMutex_6SI8OkPnk
-
aes_key
OZ5Vq4Ybn4BuUPvvVZZKEF20GdI2yi3y
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Nuevas
-
host
migracion.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
3468
-
version
0.5.7B
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1320-3-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1320-2-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-4-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-5-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1636-19-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1636-21-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1636-22-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 3 IoCs
Processes:
Googlechromee.exeGooglechromee.exejuxcgf.exepid process 572 Googlechromee.exe 1636 Googlechromee.exe 368 juxcgf.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepowershell.exepid process 772 cmd.exe 1656 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e2e89b28656886ead31cceb62f78b80b.exeGooglechromee.exedescription pid process target process PID 828 set thread context of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 572 set thread context of 1636 572 Googlechromee.exe Googlechromee.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1448 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e2e89b28656886ead31cceb62f78b80b.exepowershell.exeGooglechromee.exepid process 1320 e2e89b28656886ead31cceb62f78b80b.exe 1320 e2e89b28656886ead31cceb62f78b80b.exe 1656 powershell.exe 1636 Googlechromee.exe 1656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e2e89b28656886ead31cceb62f78b80b.exeGooglechromee.exepowershell.exedescription pid process Token: SeDebugPrivilege 1320 e2e89b28656886ead31cceb62f78b80b.exe Token: SeDebugPrivilege 1636 Googlechromee.exe Token: SeDebugPrivilege 1656 powershell.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
e2e89b28656886ead31cceb62f78b80b.exee2e89b28656886ead31cceb62f78b80b.execmd.execmd.exeGooglechromee.exeGooglechromee.execmd.exepowershell.exedescription pid process target process PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 828 wrote to memory of 1320 828 e2e89b28656886ead31cceb62f78b80b.exe e2e89b28656886ead31cceb62f78b80b.exe PID 1320 wrote to memory of 1816 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 1816 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 1816 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 1816 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 772 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 772 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 772 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1320 wrote to memory of 772 1320 e2e89b28656886ead31cceb62f78b80b.exe cmd.exe PID 1816 wrote to memory of 640 1816 cmd.exe schtasks.exe PID 1816 wrote to memory of 640 1816 cmd.exe schtasks.exe PID 1816 wrote to memory of 640 1816 cmd.exe schtasks.exe PID 1816 wrote to memory of 640 1816 cmd.exe schtasks.exe PID 772 wrote to memory of 1448 772 cmd.exe timeout.exe PID 772 wrote to memory of 1448 772 cmd.exe timeout.exe PID 772 wrote to memory of 1448 772 cmd.exe timeout.exe PID 772 wrote to memory of 1448 772 cmd.exe timeout.exe PID 772 wrote to memory of 572 772 cmd.exe Googlechromee.exe PID 772 wrote to memory of 572 772 cmd.exe Googlechromee.exe PID 772 wrote to memory of 572 772 cmd.exe Googlechromee.exe PID 772 wrote to memory of 572 772 cmd.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 572 wrote to memory of 1636 572 Googlechromee.exe Googlechromee.exe PID 1636 wrote to memory of 1492 1636 Googlechromee.exe cmd.exe PID 1636 wrote to memory of 1492 1636 Googlechromee.exe cmd.exe PID 1636 wrote to memory of 1492 1636 Googlechromee.exe cmd.exe PID 1636 wrote to memory of 1492 1636 Googlechromee.exe cmd.exe PID 1492 wrote to memory of 1656 1492 cmd.exe powershell.exe PID 1492 wrote to memory of 1656 1492 cmd.exe powershell.exe PID 1492 wrote to memory of 1656 1492 cmd.exe powershell.exe PID 1492 wrote to memory of 1656 1492 cmd.exe powershell.exe PID 1656 wrote to memory of 368 1656 powershell.exe juxcgf.exe PID 1656 wrote to memory of 368 1656 powershell.exe juxcgf.exe PID 1656 wrote to memory of 368 1656 powershell.exe juxcgf.exe PID 1656 wrote to memory of 368 1656 powershell.exe juxcgf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe"C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe"C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Googlechromee" /tr '"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Googlechromee" /tr '"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp847A.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Googlechromee.exe"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Googlechromee.exe"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\juxcgf.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\juxcgf.exe"'7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\juxcgf.exe"C:\Users\Admin\AppData\Local\Temp\juxcgf.exe"8⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\juxcgf.exeMD5
02172018da16d4d33a7d7c214f078b34
SHA150a4ec61a30f0e3c68db9ce2e32c4928c64e8722
SHA2563b02f2d57c40d4971283bf17b58de4574227c952b555590ef99a64d6b3faca00
SHA512c4011d54177ef2dd25dc5c76dde8581a139d95a5c879f8849726037e651fa5169662cbdb5aae0be074150be48514eef92be2e23af89ba57c452e706c2bea4466
-
C:\Users\Admin\AppData\Local\Temp\juxcgf.exeMD5
02172018da16d4d33a7d7c214f078b34
SHA150a4ec61a30f0e3c68db9ce2e32c4928c64e8722
SHA2563b02f2d57c40d4971283bf17b58de4574227c952b555590ef99a64d6b3faca00
SHA512c4011d54177ef2dd25dc5c76dde8581a139d95a5c879f8849726037e651fa5169662cbdb5aae0be074150be48514eef92be2e23af89ba57c452e706c2bea4466
-
C:\Users\Admin\AppData\Local\Temp\tmp847A.tmp.batMD5
58ed494fcd0d7cc2be502e83b5aa1793
SHA165a0a33b107600b5d55a8fdce2550eb7ed0ed212
SHA25669539f40a370d33504feb32eeca8ebadb359f2a27da5b3969a32c90cb020f54d
SHA5129ff8b1020d04cb39c0a9b57cfe23f07a433cc74784379e1e18509bdef646ce790d3156644c7a5fef3925a29b06b70ba60f228b54f675235320a95bc4092201f2
-
C:\Users\Admin\AppData\Roaming\Googlechromee.exeMD5
e2e89b28656886ead31cceb62f78b80b
SHA114f78bf703b0a20409f4f20d0241ff1d287963d9
SHA2567fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
SHA512054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84
-
C:\Users\Admin\AppData\Roaming\Googlechromee.exeMD5
e2e89b28656886ead31cceb62f78b80b
SHA114f78bf703b0a20409f4f20d0241ff1d287963d9
SHA2567fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
SHA512054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84
-
C:\Users\Admin\AppData\Roaming\Googlechromee.exeMD5
e2e89b28656886ead31cceb62f78b80b
SHA114f78bf703b0a20409f4f20d0241ff1d287963d9
SHA2567fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
SHA512054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84
-
\Users\Admin\AppData\Local\Temp\juxcgf.exeMD5
02172018da16d4d33a7d7c214f078b34
SHA150a4ec61a30f0e3c68db9ce2e32c4928c64e8722
SHA2563b02f2d57c40d4971283bf17b58de4574227c952b555590ef99a64d6b3faca00
SHA512c4011d54177ef2dd25dc5c76dde8581a139d95a5c879f8849726037e651fa5169662cbdb5aae0be074150be48514eef92be2e23af89ba57c452e706c2bea4466
-
\Users\Admin\AppData\Roaming\Googlechromee.exeMD5
e2e89b28656886ead31cceb62f78b80b
SHA114f78bf703b0a20409f4f20d0241ff1d287963d9
SHA2567fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
SHA512054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84
-
memory/368-30-0x0000000000000000-mapping.dmp
-
memory/572-13-0x0000000000000000-mapping.dmp
-
memory/572-14-0x0000000000000000-mapping.dmp
-
memory/640-9-0x0000000000000000-mapping.dmp
-
memory/772-7-0x0000000000000000-mapping.dmp
-
memory/828-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1320-3-0x000000000040C75E-mapping.dmp
-
memory/1320-2-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1448-10-0x0000000000000000-mapping.dmp
-
memory/1492-23-0x0000000000000000-mapping.dmp
-
memory/1636-22-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1636-21-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1636-19-0x000000000040C75E-mapping.dmp
-
memory/1656-24-0x0000000000000000-mapping.dmp
-
memory/1656-25-0x0000000000000000-mapping.dmp
-
memory/1816-6-0x0000000000000000-mapping.dmp