Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-01-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
PO20002106.exe
Resource
win7v20201028
General
-
Target
PO20002106.exe
-
Size
695KB
-
MD5
823cbb9bac152ecf6d251f686ffa1ab5
-
SHA1
c9beb84d2505636820bd357abba5af0cd5a47c52
-
SHA256
6a552b03353efc74c7871b59d8844ee8990a224de336ca893e1b74d10cd4b16b
-
SHA512
30268ed85b8b3d2d3c2d8a4ef9f0207d546be06c83cdd163b11c11ba788c159e8324c2142e946e873a017d6c3f8922550331b3ea4b25c4c02c6448c3029110b6
Malware Config
Extracted
asyncrat
0.5.7B
null:null
AsyncMutex_6SI8OkPnk
-
aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
billion
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1484-14-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1484-15-0x000000000040C77E-mapping.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO20002106.exedescription pid process target process PID 1176 set thread context of 1484 1176 PO20002106.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1484 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PO20002106.exedescription pid process target process PID 1176 wrote to memory of 1332 1176 PO20002106.exe schtasks.exe PID 1176 wrote to memory of 1332 1176 PO20002106.exe schtasks.exe PID 1176 wrote to memory of 1332 1176 PO20002106.exe schtasks.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe PID 1176 wrote to memory of 1484 1176 PO20002106.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO20002106.exe"C:\Users\Admin\AppData\Local\Temp\PO20002106.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gTxPtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6080.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6080.tmpMD5
bdb878799f61ba100be749f60718a740
SHA1249395aa88aa036a040f9caf6d5c7f9a5e8392fc
SHA25665add4f4476a4805a1bcbdce0033da9162dd492bbeef53e379e792001073aa4c
SHA51233b5280fbd0a66615f4cb8e7407d16f989a4231f4d5053b1119475b345b0b3c3c98ac845d8af8093cc0844666584c53d1601a803aec1deef0371eaa1c14e9ec1
-
memory/1176-9-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/1176-5-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1176-6-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/1176-7-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/1176-8-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1176-2-0x0000000073A70000-0x000000007415E000-memory.dmpFilesize
6.9MB
-
memory/1176-10-0x00000000052B0000-0x00000000052C7000-memory.dmpFilesize
92KB
-
memory/1176-11-0x0000000006000000-0x0000000006040000-memory.dmpFilesize
256KB
-
memory/1176-3-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/1332-12-0x0000000000000000-mapping.dmp
-
memory/1484-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-15-0x000000000040C77E-mapping.dmp
-
memory/1484-16-0x0000000073A70000-0x000000007415E000-memory.dmpFilesize
6.9MB