Analysis
- max time kernel
145s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/10/2020, 06:51
General
- Target 8a35a4d803dbc9eedcf1a4e20344b585.exe
- Size 1.5MB
- Sample201031-2xk7tm91wn
- SHA256 9ac4ff140a5b0cfe898c7f1eee2bc53cef1f4db03b7fc5c5f502d3a87f7c9393
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
C2
-
agentttt.ac.ug:6970
-
agentpurple.ac.ug:6970
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a35a4d803dbc9eedcf1a4e20344b585.exe"C:\Users\Admin\AppData\Local\Temp\8a35a4d803dbc9eedcf1a4e20344b585.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a35a4d803dbc9eedcf1a4e20344b585.exe"C:\Users\Admin\AppData\Local\Temp\8a35a4d803dbc9eedcf1a4e20344b585.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3744-5-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3744-8-0x0000000073370000-0x0000000073A5E000-memory.dmp
memory/4768-0-0x0000000073370000-0x0000000073A5E000-memory.dmp
memory/4768-1-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/4768-3-0x0000000001740000-0x0000000001780000-memory.dmp
memory/4768-4-0x0000000005450000-0x0000000005466000-memory.dmp