Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 20:08
Static task
static1
Behavioral task
behavioral1
Sample
CONTRACT_87908.exe
Resource
win7v20201028
General
-
Target
CONTRACT_87908.exe
-
Size
842KB
-
MD5
044be31c4ec02f25b5627cf889d581d6
-
SHA1
caba9cc3c77d49aa4f2f2f3bb3b6b779dd7ad1b1
-
SHA256
8b3bcce39aee0df9fc37b2f009ecc2e9c570c665f632c576f7ae8c2f32a87a1d
-
SHA512
13e8542241251a9886f91c8d429bcc49394719395092ab42c243f2a9f6a32a520fda529f2ac91371aeec320b84403429e399b00131541284f0fdcef9d2c0af6a
Malware Config
Extracted
asyncrat
0.5.6D
91.193.75.182:8808
:8808
iqtkuvwaczxdagzqzrf
-
aes_key
MtZYMqjMdClo4OGaE86hJg0xTpxOqdzU
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
TLVAudio
-
host
91.193.75.182,
-
hwid
1
- install_file
-
install_folder
%AppData%
-
mutex
iqtkuvwaczxdagzqzrf
-
pastebin_config
null
-
port
8808
-
version
0.5.6D
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/316-9-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/316-10-0x000000000040C62E-mapping.dmp asyncrat behavioral1/memory/316-11-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/316-12-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CONTRACT_87908.exedescription pid process target process PID 1644 set thread context of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
CONTRACT_87908.exedescription pid process target process PID 1644 wrote to memory of 1404 1644 CONTRACT_87908.exe schtasks.exe PID 1644 wrote to memory of 1404 1644 CONTRACT_87908.exe schtasks.exe PID 1644 wrote to memory of 1404 1644 CONTRACT_87908.exe schtasks.exe PID 1644 wrote to memory of 1404 1644 CONTRACT_87908.exe schtasks.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe PID 1644 wrote to memory of 316 1644 CONTRACT_87908.exe CONTRACT_87908.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmJrjp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE540.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE540.tmpMD5
e5e267e3b78c80aec4789cfd0a74d6fc
SHA15813791de575d2079a02289e70217d87136705fd
SHA2566446930865911b48b2383b2b792d644f94e09017885430ee445164702d355098
SHA51225f25d56644aba02864e8928994c2278efc6abc21e545ecaf271532c4d175c96d251fb8a5098fe7b59667296acdee282caef3cb31377e7836f6f36bf4828b7be
-
memory/316-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/316-10-0x000000000040C62E-mapping.dmp
-
memory/316-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/316-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/316-13-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/1404-7-0x0000000000000000-mapping.dmp
-
memory/1644-2-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/1644-3-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1644-5-0x00000000002D0000-0x00000000002E2000-memory.dmpFilesize
72KB
-
memory/1644-6-0x0000000002270000-0x00000000022B9000-memory.dmpFilesize
292KB