Analysis
- max time kernel
145s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/02/2021, 16:26
General
- Target 413743f8b05dedc18e9d2d2fbe5d6528.exe
- Size 708KB
- Sample210223-vty5pcbga2
- SHA256 9b2db2aaf8c526dff498520e35898c5f3ef718ec198e267a40bfadd926bd358a
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
newtechublil.ddns.net:8675
-
AsyncMutex_6SI8OkPnk
-
aes_key
7LFFyVixjyhf0KX4VXKiRabxMh1ZDDJ3
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
foxzzyasync
-
host
newtechublil.ddns.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
8675
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mWSqBKhLOazUTy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33CE.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"C:\Users\Admin\AppData\Local\Temp\413743f8b05dedc18e9d2d2fbe5d6528.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-20-0x0000000005380000-0x0000000005381000-memory.dmp
memory/560-17-0x0000000073D20000-0x000000007440E000-memory.dmp
memory/560-14-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1192-7-0x0000000005250000-0x0000000005251000-memory.dmp
memory/1192-10-0x0000000005470000-0x0000000005471000-memory.dmp
memory/1192-11-0x0000000000D60000-0x0000000000D93000-memory.dmp
memory/1192-9-0x0000000005220000-0x0000000005223000-memory.dmp
memory/1192-8-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1192-2-0x0000000073D20000-0x000000007440E000-memory.dmp
memory/1192-6-0x0000000005110000-0x0000000005111000-memory.dmp
memory/1192-5-0x0000000005750000-0x0000000005751000-memory.dmp
memory/1192-3-0x0000000000690000-0x0000000000691000-memory.dmp