Overview

overview

10

Static

static

Readmore Details.exe

windows7_x64

10

Readmore Details.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    31/08/2020, 06:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Readmore Details.exe
  • Size 268KB
  • Sample200831-y52czrfyaa
  • SHA256 4cfe4e820c2d2b070d71009beaa98c9f7dce82de24266a344b743c7f47fea142
  • MD5 SHA1 SHA512
Score
10/10
asyncratrat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

C2

  • 103.207.39.83:1024

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    Oi0RrCNihU0ouBbxmnmtbPOiiWGchtFB

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    103.207.39.83

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    1024

  • version

    0.5.7B

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 4 IoCs
    rat
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14893 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Readmore Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Readmore Details.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3688
    • C:\Users\Admin\AppData\Local\Temp\Readmore Details.exe
      "C:\Users\Admin\AppData\Local\Temp\Readmore Details.exe"
      2⤵
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3548
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1224

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/728-0-0x00000000736B0000-0x0000000073D9E000-memory.dmp
          Download

          memory/728-1-0x0000000000590000-0x0000000000591000-memory.dmp
          Download

          memory/728-3-0x0000000004F50000-0x0000000004F51000-memory.dmp
          Download

          memory/728-4-0x00000000056E0000-0x00000000056F3000-memory.dmp
          Download

          memory/3548-23-0x00000000736B0000-0x0000000073D9E000-memory.dmp
          Download

          memory/3688-19-0x0000000006590000-0x0000000006591000-memory.dmp
          Download

          memory/3688-27-0x0000000006ED0000-0x0000000006F49000-memory.dmp
          Download

          memory/3688-34-0x00000000014F0000-0x000000000150B000-memory.dmp
          Download

          memory/3688-18-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
          Download

          memory/3688-8-0x00000000736B0000-0x0000000073D9E000-memory.dmp
          Download

          memory/3688-20-0x0000000006100000-0x0000000006101000-memory.dmp
          Download

          memory/3688-6-0x0000000000400000-0x0000000000412000-memory.dmp
          Download

          memory/3688-26-0x0000000006F50000-0x0000000006F51000-memory.dmp
          Download

          memory/3688-33-0x0000000006D90000-0x0000000006D91000-memory.dmp
          Download

          memory/3688-28-0x0000000007010000-0x0000000007011000-memory.dmp
          Download

          memory/3688-29-0x0000000007110000-0x0000000007111000-memory.dmp
          Download

          memory/3688-30-0x0000000007080000-0x0000000007084000-memory.dmp
          Download

          memory/3688-31-0x00000000074D0000-0x000000000755D000-memory.dmp
          Download

          memory/3688-32-0x0000000007660000-0x00000000076B9000-memory.dmp
          Download

          memory/4052-12-0x00000000736B0000-0x0000000073D9E000-memory.dmp
          Download