Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
14/10/2020, 14:50
General
- Target 3df64089a8d0a796445361f8b0141bd8.exe
- Size 533KB
- Sample201014-k6ntk4cege
- SHA256 307f004326e684ce02104a8da2db8f3cfa93c4e1ab2d7da025204430d677f75d
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
agentttt.ac.ug,agentpurple.ac.ug:6970
-
AsyncMutex_6SI8OkPnk
-
aes_key
s8CEqY6pD21gSg7xELYD1QWGg2YpwLUB
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddcvlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"C:\Users\Admin\AppData\Local\Temp\3df64089a8d0a796445361f8b0141bd8.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2128-21-0x0000000008820000-0x0000000008821000-memory.dmp
memory/2128-7-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/2128-35-0x0000000009A00000-0x0000000009A01000-memory.dmp
memory/2128-33-0x0000000009A10000-0x0000000009A11000-memory.dmp
memory/2128-32-0x0000000009A60000-0x0000000009A61000-memory.dmp
memory/2128-15-0x00000000076F0000-0x00000000076F1000-memory.dmp
memory/2128-31-0x00000000098B0000-0x00000000098B1000-memory.dmp
memory/2128-11-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/2128-30-0x0000000009530000-0x0000000009531000-memory.dmp
memory/2128-23-0x0000000009550000-0x0000000009583000-memory.dmp
memory/2128-13-0x0000000007A30000-0x0000000007A31000-memory.dmp
memory/2128-20-0x0000000008750000-0x0000000008751000-memory.dmp
memory/2128-17-0x0000000008060000-0x0000000008061000-memory.dmp
memory/2128-18-0x00000000080D0000-0x00000000080D1000-memory.dmp
memory/2128-19-0x00000000084A0000-0x00000000084A1000-memory.dmp
memory/2128-16-0x0000000007790000-0x0000000007791000-memory.dmp
memory/2480-10-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/2480-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4016-0-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/4016-3-0x00000000024F0000-0x000000000250A000-memory.dmp
memory/4016-1-0x0000000000330000-0x0000000000331000-memory.dmp
memory/4016-5-0x0000000002630000-0x000000000263D000-memory.dmp