Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:09
General
- Target 3c59ce6c1cef9dbc4808d9c10e90f83d.exe
- Size 234KB
- Sample201109-vvlr8ca31j
- SHA256 5b0ffdd98aa6a53e13e00b7723f9c8085e7b03356c5ec4e77cc88c9779011b74
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
moveforme.ug:6970
-
xafsavxcfdgbdsfg.ru:6970
-
AsyncMutex_ggkanor
-
aes_key
li2MB48BWA2H16sJwngH2ceTNgp1xxPb
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Spread
-
host
moveforme.ug,xafsavxcfdgbdsfg.ru
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_ggkanor
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
- Async RAT payload 2 IoCs
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe"C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RSIHBty" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A7E.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe"{path}"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-14-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/2484-11-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3408-4-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/3408-8-0x00000000096A0000-0x00000000096A1000-memory.dmp
memory/3408-7-0x0000000009070000-0x0000000009083000-memory.dmp
memory/3408-6-0x0000000008F90000-0x0000000008F92000-memory.dmp
memory/3408-5-0x0000000007350000-0x0000000007351000-memory.dmp
memory/3408-0-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/3408-3-0x0000000007810000-0x0000000007811000-memory.dmp
memory/3408-1-0x0000000000610000-0x0000000000611000-memory.dmp