Analysis
- max time kernel
108s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
01/09/2020, 15:25
General
- Target 2020.09.01.SS.08.39_Export.pdf.exe
- Size 886KB
- Sample200901-3z3yj5xffn
- SHA256 aa9c8f532405507cb8a00d6c0d4ecd6888df2524037cde8d3d6fb33ff52bfb91
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
null:null
-
AsyncMutex_6SI8OkPnk
-
aes_key
lA8RQD4nJOJ7VPvDUvwml7lHNC1FRpLN
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Kc
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/iWWxBLnx
-
port
null
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2020.09.01.SS.08.39_Export.pdf.exe"C:\Users\Admin\AppData\Local\Temp\2020.09.01.SS.08.39_Export.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JqPJryrfLBhOF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7020.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2136-20-0x0000000005D10000-0x0000000005D11000-memory.dmp
memory/2136-15-0x0000000073980000-0x000000007406E000-memory.dmp
memory/2136-13-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2920-5-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/2920-8-0x0000000003060000-0x000000000306B000-memory.dmp
memory/2920-9-0x00000000061C0000-0x00000000061EB000-memory.dmp
memory/2920-10-0x0000000005BA0000-0x0000000005BB1000-memory.dmp
memory/2920-7-0x0000000005780000-0x0000000005781000-memory.dmp
memory/2920-6-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2920-0-0x0000000073980000-0x000000007406E000-memory.dmp
memory/2920-4-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/2920-3-0x0000000005500000-0x0000000005501000-memory.dmp
memory/2920-1-0x0000000000B90000-0x0000000000B91000-memory.dmp