Overview

overview

10

Static

static

80dbc24d7d...a1.exe

windows7_x64

10

80dbc24d7d...a1.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    04/08/2020, 06:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    80dbc24d7db7989a9ab3cb46bdad3aa1.exe
  • Size 679KB
  • Sample200804-nl8a321m8a
  • SHA256 e45aa38e4f734a6b5e9d8e55d3b71b16e4ae389eb7c857bbdaa98fb47e1d9ef3
  • MD5 SHA1 SHA512
Score
10/10
asyncratratupx

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

C2

  • 185.165.153.209:1990

  • :1990

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    ZIE6PXUAIMR7hz7DnlsGjtGT7L9ND60z

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    185.165.153.209,

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    1990

  • version

    0.5.7B

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 2 IoCs
    rat
  • Executes dropped EXE 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2686 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80dbc24d7db7989a9ab3cb46bdad3aa1.exe
    "C:\Users\Admin\AppData\Local\Temp\80dbc24d7db7989a9ab3cb46bdad3aa1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      2⤵
      • Drops startup file
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe
        "C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe
          "C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe"
          4⤵
          • Executes dropped EXE
          PID:2892
        • C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe
          "C:\Users\Admin\AppData\Roaming\appdata\dakfscec.exe" 2 2892 93468
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:500

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2892-4-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2892-8-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2892-9-0x0000000000400000-0x0000000000430000-memory.dmp
        Download

        memory/2892-11-0x0000000000590000-0x00000000005A2000-memory.dmp
        Download

        memory/2892-12-0x00000000022F2000-0x00000000022F3000-memory.dmp
        Download