Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:08
Static task
static1
Behavioral task
behavioral1
Sample
CONTRACT_87908.exe
Resource
win7v20201028
General
-
Target
CONTRACT_87908.exe
-
Size
842KB
-
MD5
044be31c4ec02f25b5627cf889d581d6
-
SHA1
caba9cc3c77d49aa4f2f2f3bb3b6b779dd7ad1b1
-
SHA256
8b3bcce39aee0df9fc37b2f009ecc2e9c570c665f632c576f7ae8c2f32a87a1d
-
SHA512
13e8542241251a9886f91c8d429bcc49394719395092ab42c243f2a9f6a32a520fda529f2ac91371aeec320b84403429e399b00131541284f0fdcef9d2c0af6a
Malware Config
Extracted
asyncrat
0.5.6D
91.193.75.182:8808
:8808
iqtkuvwaczxdagzqzrf
-
aes_key
MtZYMqjMdClo4OGaE86hJg0xTpxOqdzU
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
TLVAudio
-
host
91.193.75.182,
-
hwid
1
- install_file
-
install_folder
%AppData%
-
mutex
iqtkuvwaczxdagzqzrf
-
pastebin_config
null
-
port
8808
-
version
0.5.6D
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1528-13-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1528-14-0x000000000040C62E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CONTRACT_87908.exedescription pid process target process PID 672 set thread context of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
CONTRACT_87908.exedescription pid process target process PID 672 wrote to memory of 2252 672 CONTRACT_87908.exe schtasks.exe PID 672 wrote to memory of 2252 672 CONTRACT_87908.exe schtasks.exe PID 672 wrote to memory of 2252 672 CONTRACT_87908.exe schtasks.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe PID 672 wrote to memory of 1528 672 CONTRACT_87908.exe CONTRACT_87908.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmJrjp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F9E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT_87908.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CONTRACT_87908.exe.logMD5
c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
C:\Users\Admin\AppData\Local\Temp\tmp8F9E.tmpMD5
262310dce417c8ba8b6287256b4335be
SHA19ac82ac76aee030fad2a250977d1f5b6b4815e87
SHA2564275c719dbb75a0880930b9617f85f378a57211b91073da00a4aa1066941b6ca
SHA512d0ebd1b287b6a187997405ef19f7ca8f78786937726591e4edb504d880c5c6981443f912d77ab41851411eda68a61b074afdfb1a69f55b99147f0bb1532c62ff
-
memory/672-6-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/672-2-0x0000000073FF0000-0x00000000746DE000-memory.dmpFilesize
6.9MB
-
memory/672-7-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/672-8-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/672-9-0x0000000004960000-0x0000000004972000-memory.dmpFilesize
72KB
-
memory/672-10-0x0000000005630000-0x0000000005679000-memory.dmpFilesize
292KB
-
memory/672-5-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/672-3-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/1528-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1528-14-0x000000000040C62E-mapping.dmp
-
memory/1528-16-0x0000000073FF0000-0x00000000746DE000-memory.dmpFilesize
6.9MB
-
memory/2252-11-0x0000000000000000-mapping.dmp