Analysis
- max time kernel
149s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
23/02/2021, 16:26
General
- Target 413743f8b05dedc18e9d2d2fbe5d6528.exe
- Size 708KB
- Sample210223-vty5pcbga2
- SHA256 9b2db2aaf8c526dff498520e35898c5f3ef718ec198e267a40bfadd926bd358a
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
newtechublil.ddns.net:8675
-
AsyncMutex_6SI8OkPnk
-
aes_key
7LFFyVixjyhf0KX4VXKiRabxMh1ZDDJ3
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
foxzzyasync
-
host
newtechublil.ddns.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
8675
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mWSqBKhLOazUTy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB90.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-12-0x0000000074320000-0x0000000074A0E000-memory.dmp
memory/1148-10-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1148-13-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1148-15-0x0000000075781000-0x0000000075783000-memory.dmp
memory/1148-16-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/1888-6-0x0000000000430000-0x0000000000433000-memory.dmp
memory/1888-7-0x0000000000BB0000-0x0000000000BE3000-memory.dmp
memory/1888-5-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/1888-3-0x00000000012B0000-0x00000000012B1000-memory.dmp
memory/1888-2-0x0000000074320000-0x0000000074A0E000-memory.dmp