Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
18/10/2020, 10:55
General
- Target a077d5b666cb684165c3a0783c3a1071.exe
- Size 214KB
- Sample201018-jgz32ghbcj
- SHA256 5b832740ae1f2a5c2c10e37aadd6d0b74d647a9ff853f091a2262ef0ae2c672c
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
agentttt.ac.ug,agentpurple.ac.ug:6970
-
AsyncMutex_6SI8OkPnk
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a077d5b666cb684165c3a0783c3a1071.exe"C:\Users\Admin\AppData\Local\Temp\a077d5b666cb684165c3a0783c3a1071.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\dcvlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a077d5b666cb684165c3a0783c3a1071.exe"C:\Users\Admin\AppData\Local\Temp\a077d5b666cb684165c3a0783c3a1071.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1028-15-0x0000000006D40000-0x0000000006D41000-memory.dmp
memory/1028-7-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1028-34-0x0000000008FB0000-0x0000000008FB1000-memory.dmp
memory/1028-32-0x0000000008FC0000-0x0000000008FC1000-memory.dmp
memory/1028-31-0x0000000009010000-0x0000000009011000-memory.dmp
memory/1028-14-0x0000000006CA0000-0x0000000006CA1000-memory.dmp
memory/1028-30-0x0000000008E60000-0x0000000008E61000-memory.dmp
memory/1028-10-0x0000000004240000-0x0000000004241000-memory.dmp
memory/1028-29-0x0000000008CF0000-0x0000000008CF1000-memory.dmp
memory/1028-22-0x0000000008D30000-0x0000000008D63000-memory.dmp
memory/1028-12-0x0000000006DB0000-0x0000000006DB1000-memory.dmp
memory/1028-19-0x0000000008000000-0x0000000008001000-memory.dmp
memory/1028-16-0x00000000075C0000-0x00000000075C1000-memory.dmp
memory/1028-17-0x0000000007630000-0x0000000007631000-memory.dmp
memory/1028-18-0x0000000007A40000-0x0000000007A41000-memory.dmp
memory/1028-20-0x0000000007D40000-0x0000000007D41000-memory.dmp
memory/1264-9-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1264-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3848-0-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/3848-1-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/3848-5-0x0000000004B50000-0x0000000004B5C000-memory.dmp
memory/3848-3-0x0000000004B20000-0x0000000004B3A000-memory.dmp