Analysis
- max time kernel
138s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/02/2021, 07:14
General
- Target e64ee5e919628d70b6a326b8a4954fda294d41944f45b7dfcc8214e3d2d2a6e4.exe
- Size 153KB
- Sample210228-xsvdb6vlf2
- SHA256 e64ee5e919628d70b6a326b8a4954fda294d41944f45b7dfcc8214e3d2d2a6e4
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
190.247.124.60:6821
-
AsyncMutex_6SI8OkPnk
-
aes_key
KR5IUkWQv1BbZs0nm3udIa9b2I1BuhCr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
190.247.124.60
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6821
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e64ee5e919628d70b6a326b8a4954fda294d41944f45b7dfcc8214e3d2d2a6e4.exe"C:\Users\Admin\AppData\Local\Temp\e64ee5e919628d70b6a326b8a4954fda294d41944f45b7dfcc8214e3d2d2a6e4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mazmftwea.exe"C:\Users\Admin\AppData\Local\Temp\Mazmftwea.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mazmftwea.exe"C:\Users\Admin\AppData\Local\Temp\Mazmftwea.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-8-0x0000000002460000-0x0000000002461000-memory.dmp
memory/1052-7-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/1052-2-0x0000000073940000-0x000000007402E000-memory.dmp
memory/1052-23-0x0000000002463000-0x0000000002465000-memory.dmp
memory/1052-6-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/1052-5-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/1052-3-0x0000000000400000-0x0000000000401000-memory.dmp
memory/2124-17-0x0000000005400000-0x0000000005402000-memory.dmp
memory/2124-15-0x0000000001440000-0x000000000144E000-memory.dmp
memory/2124-13-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/2124-12-0x0000000073940000-0x000000007402E000-memory.dmp
memory/2124-22-0x0000000005440000-0x0000000005441000-memory.dmp
memory/2420-18-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2420-21-0x0000000073940000-0x000000007402E000-memory.dmp
memory/2420-26-0x00000000052E0000-0x00000000052E1000-memory.dmp