Analysis
-
max time kernel
41s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-01-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
IMG 01-06-2021 93899283.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
IMG 01-06-2021 93899283.exe
-
Size
219KB
-
MD5
dd319982f0f20d472f466d7e3598d18b
-
SHA1
de92836d855354abcf1a1c88093d6c3cbf009545
-
SHA256
fcfda22e8938ce7846eb3494af9778f601b676df3446a0b5b1a710c08d632010
-
SHA512
6d55f84ed9ac2c01f8bb47fababbd6a99297776633531049793a4970f57dff2cfa3ce54a536facd64163ebda48f50b9a620b0046a596c818dc434caef36c921c
Malware Config
Extracted
Family
asyncrat
Version
0.5.6A
C2
194.5.97.177:10011
Mutex
zsmnadpzmacboobggxc
Attributes
-
aes_key
oY4R2ZxJTae5ZkR4Z3caW1vvsIe5MAmF
-
anti_detection
false
-
autorun
false
-
bdos
false
- delay
-
host
194.5.97.177
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
zsmnadpzmacboobggxc
-
pastebin_config
null
-
port
10011
-
version
0.5.6A
aes.plain
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1864-11-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1864-12-0x000000000040C39E-mapping.dmp asyncrat -
Drops startup file 2 IoCs
Processes:
IMG 01-06-2021 93899283.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
IMG 01-06-2021 93899283.exedescription pid process target process PID 3992 set thread context of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
IMG 01-06-2021 93899283.exeIMG 01-06-2021 93899283.exepid process 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 3992 IMG 01-06-2021 93899283.exe 1864 IMG 01-06-2021 93899283.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
IMG 01-06-2021 93899283.exeIMG 01-06-2021 93899283.exedescription pid process Token: SeDebugPrivilege 3992 IMG 01-06-2021 93899283.exe Token: SeDebugPrivilege 1864 IMG 01-06-2021 93899283.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
IMG 01-06-2021 93899283.exedescription pid process target process PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe PID 3992 wrote to memory of 1864 3992 IMG 01-06-2021 93899283.exe IMG 01-06-2021 93899283.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG 01-06-2021 93899283.exe"C:\Users\Admin\AppData\Local\Temp\IMG 01-06-2021 93899283.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG 01-06-2021 93899283.exe"C:\Users\Admin\AppData\Local\Temp\IMG 01-06-2021 93899283.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1864-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-12-0x000000000040C39E-mapping.dmp
-
memory/1864-13-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3992-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3992-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/3992-5-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/3992-6-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3992-7-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/3992-8-0x0000000005510000-0x0000000005537000-memory.dmpFilesize
156KB
-
memory/3992-9-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3992-10-0x0000000006150000-0x0000000006151000-memory.dmpFilesize
4KB