Analysis
- max time kernel
146s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:58
General
- Target 454425 new index-payment reminder.exe
- Size 621KB
- Sample201109-8xpm73lfea
- SHA256 7caf87ac1666f10cbbff4cc01d51ec4df556908b2d8d55d5c4f0f3724dceded1
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
194.5.98.129:5554
-
:5554
-
AsyncMutex_6SI8OkPnk
-
aes_key
NuT9YGfJvCNQ28ph8FCCPeKFrzak5ypN
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
194.5.98.129,
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
5554
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\454425 new index-payment reminder.exe"C:\Users\Admin\AppData\Local\Temp\454425 new index-payment reminder.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2644-11-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2644-15-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/3408-7-0x0000000005110000-0x0000000005112000-memory.dmp
memory/3408-0-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/3408-8-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/3408-9-0x0000000005120000-0x0000000005122000-memory.dmp
memory/3408-10-0x0000000006080000-0x0000000006081000-memory.dmp
memory/3408-6-0x0000000005030000-0x0000000005031000-memory.dmp
memory/3408-5-0x00000000010D0000-0x00000000010D2000-memory.dmp
memory/3408-4-0x0000000005450000-0x0000000005451000-memory.dmp
memory/3408-3-0x0000000000DC0000-0x0000000000DCE000-memory.dmp
memory/3408-1-0x0000000000610000-0x0000000000611000-memory.dmp