Analysis
- max time kernel
151s - max time network
139s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 14:50
General
- Target 3df64089a8d0a796445361f8b0141bd8.exe
- Size 533KB
- Sample201014-k6ntk4cege
- SHA256 307f004326e684ce02104a8da2db8f3cfa93c4e1ab2d7da025204430d677f75d
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
agentttt.ac.ug,agentpurple.ac.ug:6970
-
AsyncMutex_6SI8OkPnk
-
aes_key
s8CEqY6pD21gSg7xELYD1QWGg2YpwLUB
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddcvlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/524-20-0x0000000005660000-0x0000000005661000-memory.dmp
memory/524-25-0x0000000006060000-0x0000000006061000-memory.dmp
memory/524-49-0x0000000006310000-0x0000000006311000-memory.dmp
memory/524-48-0x0000000006300000-0x0000000006301000-memory.dmp
memory/524-34-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/524-33-0x00000000061B0000-0x00000000061B1000-memory.dmp
memory/524-26-0x0000000006220000-0x0000000006221000-memory.dmp
memory/524-13-0x0000000074810000-0x0000000074EFE000-memory.dmp
memory/524-15-0x00000000048F0000-0x00000000048F1000-memory.dmp
memory/524-17-0x0000000004850000-0x0000000004851000-memory.dmp
memory/524-14-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/524-16-0x0000000001050000-0x0000000001051000-memory.dmp
memory/1508-1-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/1508-0-0x0000000074810000-0x0000000074EFE000-memory.dmp
memory/1508-5-0x0000000000270000-0x000000000027D000-memory.dmp
memory/1508-3-0x0000000000240000-0x000000000025A000-memory.dmp
memory/1572-10-0x0000000074810000-0x0000000074EFE000-memory.dmp
memory/1572-9-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1572-8-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1572-6-0x0000000000400000-0x0000000000412000-memory.dmp