Analysis
- max time kernel
146s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
16/10/2020, 18:03
General
- Target 382cbf580429a1b47d2c8d8db13f0a20.exe
- Size 456KB
- Sample201016-tbfbtagm1x
- SHA256 3d51c6c8739a9038ef4a2fd3c255ccb1206ea5e4e148af61ec47867395d3540d
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
agentttt.ac.ug,agentpurple.ac.ug:6970
-
AsyncMutex_6SI8OkPnk
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe"C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddvlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe"C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1568-15-0x0000000008280000-0x0000000008281000-memory.dmp
memory/1568-6-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1568-34-0x0000000009CD0000-0x0000000009CD1000-memory.dmp
memory/1568-32-0x0000000009CE0000-0x0000000009CE1000-memory.dmp
memory/1568-31-0x0000000009D30000-0x0000000009D31000-memory.dmp
memory/1568-14-0x0000000008000000-0x0000000008001000-memory.dmp
memory/1568-30-0x0000000009B90000-0x0000000009B91000-memory.dmp
memory/1568-9-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/1568-11-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/1568-29-0x0000000009800000-0x0000000009801000-memory.dmp
memory/1568-22-0x0000000009820000-0x0000000009853000-memory.dmp
memory/1568-19-0x00000000087D0000-0x00000000087D1000-memory.dmp
memory/1568-16-0x00000000082F0000-0x00000000082F1000-memory.dmp
memory/1568-17-0x0000000008360000-0x0000000008361000-memory.dmp
memory/1568-18-0x0000000008260000-0x0000000008261000-memory.dmp
memory/1568-20-0x0000000008AB0000-0x0000000008AB1000-memory.dmp
memory/1900-10-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1900-7-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3044-0-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/3044-1-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/3044-5-0x0000000004CC0000-0x0000000004CCC000-memory.dmp
memory/3044-3-0x0000000004CA0000-0x0000000004CB9000-memory.dmp