Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-01-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
PO20002106.exe
Resource
win7v20201028
General
-
Target
PO20002106.exe
-
Size
695KB
-
MD5
823cbb9bac152ecf6d251f686ffa1ab5
-
SHA1
c9beb84d2505636820bd357abba5af0cd5a47c52
-
SHA256
6a552b03353efc74c7871b59d8844ee8990a224de336ca893e1b74d10cd4b16b
-
SHA512
30268ed85b8b3d2d3c2d8a4ef9f0207d546be06c83cdd163b11c11ba788c159e8324c2142e946e873a017d6c3f8922550331b3ea4b25c4c02c6448c3029110b6
Malware Config
Extracted
asyncrat
0.5.7B
null:null
AsyncMutex_6SI8OkPnk
-
aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
billion
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-9-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1556-10-0x000000000040C77E-mapping.dmp asyncrat behavioral1/memory/1556-11-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1556-12-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO20002106.exedescription pid process target process PID 1472 set thread context of 1556 1472 PO20002106.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO20002106.exepid process 1472 PO20002106.exe 1472 PO20002106.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO20002106.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1472 PO20002106.exe Token: SeDebugPrivilege 1556 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO20002106.exedescription pid process target process PID 1472 wrote to memory of 1688 1472 PO20002106.exe schtasks.exe PID 1472 wrote to memory of 1688 1472 PO20002106.exe schtasks.exe PID 1472 wrote to memory of 1688 1472 PO20002106.exe schtasks.exe PID 1472 wrote to memory of 1688 1472 PO20002106.exe schtasks.exe PID 1472 wrote to memory of 1004 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1004 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1004 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1004 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe PID 1472 wrote to memory of 1556 1472 PO20002106.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO20002106.exe"C:\Users\Admin\AppData\Local\Temp\PO20002106.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gTxPtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8DD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA8DD.tmpMD5
d3e37080b5ff48ae8e68c1fcfd46dff4
SHA131cae06704bce113f42654356ff3b3dfb5b6525b
SHA25675ff954459a77735c3d0330d072f2e9f82bc08117df653af61724d0bbf8fa7d7
SHA512fabfc4a4d0d0060e495f8c66503f82a3c988cda6e89da1cb2a855fc894c5525dd636a1c3fe456160f95cfbee341d71d440fd51e4db7930679a60e3c89164960e
-
memory/1472-2-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1472-3-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/1472-5-0x0000000000440000-0x0000000000457000-memory.dmpFilesize
92KB
-
memory/1472-6-0x0000000000B10000-0x0000000000B50000-memory.dmpFilesize
256KB
-
memory/1556-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1556-10-0x000000000040C77E-mapping.dmp
-
memory/1556-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1556-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1556-13-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1688-7-0x0000000000000000-mapping.dmp