Analysis
- max time kernel
147s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:58
General
- Target 454425 new index-payment reminder.exe
- Size 621KB
- Sample201109-8xpm73lfea
- SHA256 7caf87ac1666f10cbbff4cc01d51ec4df556908b2d8d55d5c4f0f3724dceded1
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
194.5.98.129:5554
-
:5554
-
AsyncMutex_6SI8OkPnk
-
aes_key
NuT9YGfJvCNQ28ph8FCCPeKFrzak5ypN
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
194.5.98.129,
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
5554
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\454425 new index-payment reminder.exe"C:\Users\Admin\AppData\Local\Temp\454425 new index-payment reminder.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1724-12-0x0000000000080000-0x0000000000092000-memory.dmp
memory/1724-11-0x0000000000080000-0x0000000000092000-memory.dmp
memory/1724-14-0x00000000736B0000-0x0000000073D9E000-memory.dmp
memory/1724-15-0x0000000000080000-0x0000000000082000-memory.dmp
memory/1848-5-0x0000000000360000-0x0000000000362000-memory.dmp
memory/1848-6-0x0000000000470000-0x0000000000472000-memory.dmp
memory/1848-4-0x0000000000340000-0x0000000000342000-memory.dmp
memory/1848-3-0x0000000000260000-0x000000000026E000-memory.dmp
memory/1848-0-0x00000000742C0000-0x00000000749AE000-memory.dmp
memory/1848-1-0x0000000000290000-0x0000000000291000-memory.dmp