Analysis
- max time kernel
130s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/03/2021, 07:24
General
- Target item list _ pdf.exe
- Size 651KB
- Sample210304-wd74v9py52
- SHA256 c7b35f96dd3b10e207d17ad146b9be7ea80ae88a0370ce0a5ae5f9681a87fc2c
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
08099311.duckdns.org:1508
-
AsyncMutex_6SI8OkPnk
-
aes_key
JI4HPrvlgZKb8ff05fl4tk29kOZYmGtv
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
08099311.duckdns.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
1508
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\item list _ pdf.exe"C:\Users\Admin\AppData\Local\Temp\item list _ pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ffLOkPIzLgwU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\item list _ pdf.exe"C:\Users\Admin\AppData\Local\Temp\item list _ pdf.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1400-9-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/1400-6-0x0000000005940000-0x0000000005941000-memory.dmp
memory/1400-7-0x0000000005310000-0x0000000005311000-memory.dmp
memory/1400-8-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/1400-5-0x0000000005270000-0x0000000005271000-memory.dmp
memory/1400-10-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/1400-11-0x0000000005400000-0x0000000005407000-memory.dmp
memory/1400-12-0x00000000058D0000-0x0000000005901000-memory.dmp
memory/1400-3-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1400-2-0x0000000073FB0000-0x000000007469E000-memory.dmp
memory/2524-15-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2524-18-0x0000000073FB0000-0x000000007469E000-memory.dmp
memory/2524-21-0x0000000005540000-0x0000000005541000-memory.dmp
memory/2524-24-0x00000000060D0000-0x00000000060D1000-memory.dmp
memory/2524-25-0x0000000006F10000-0x0000000006F11000-memory.dmp
memory/2524-26-0x0000000006E90000-0x0000000006F09000-memory.dmp
memory/2524-27-0x0000000007010000-0x0000000007011000-memory.dmp
memory/2524-28-0x0000000007110000-0x0000000007111000-memory.dmp
memory/2524-29-0x0000000007080000-0x0000000007084000-memory.dmp
memory/2524-30-0x00000000074D0000-0x000000000755D000-memory.dmp
memory/2524-31-0x0000000007670000-0x00000000076C9000-memory.dmp
memory/2524-32-0x00000000076D0000-0x00000000076D1000-memory.dmp