Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-04-2021 01:06
Static task
static1
Behavioral task
behavioral1
Sample
7CA736BA6C5898C997FD82042EB2B4A3.exe
Resource
win7v20210408
General
-
Target
7CA736BA6C5898C997FD82042EB2B4A3.exe
-
Size
459KB
-
MD5
7ca736ba6c5898c997fd82042eb2b4a3
-
SHA1
258a71bd04ff5e3da545d941bb962de998fcb356
-
SHA256
a57e3df4a9633d46ac59b6a45a3ad21357acbf5182e841e16a820edf81138bb6
-
SHA512
6bf4d9251573d23de947f4ad3acba0162fdc748e7338eba6346201c09d48c4261105a3459132258fc6a22f3517ee1c3362c1c439d5287a50f4d2a48f23d10c16
Malware Config
Extracted
asyncrat
:
- aes_key
- anti_detection
- autorun
- bdos
- delay
- host
-
hwid
Write
- install_file
-
install_folder
xs4F7VPUmodOruvSvV.DMOM3d1QV9uxb9cuEw
- mutex
- pastebin_config
- port
- version
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 748 InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exepid process 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exedescription pid process target process PID 1832 set thread context of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exepowershell.exepid process 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe 1644 powershell.exe 1644 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 748 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exedescription pid process target process PID 1832 wrote to memory of 1644 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 1832 wrote to memory of 1644 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 1832 wrote to memory of 1644 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 1832 wrote to memory of 1644 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 1832 wrote to memory of 748 1832 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7CA736BA6C5898C997FD82042EB2B4A3.exe"C:\Users\Admin\AppData\Local\Temp\7CA736BA6C5898C997FD82042EB2B4A3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/748-76-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/748-72-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/748-69-0x00000000004256FE-mapping.dmp
-
memory/748-68-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1644-66-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1644-88-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1644-65-0x0000000000000000-mapping.dmp
-
memory/1644-113-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1644-112-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1644-98-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1644-74-0x00000000023B0000-0x00000000023B1000-memory.dmpFilesize
4KB
-
memory/1644-75-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/1644-97-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1644-77-0x00000000020E0000-0x0000000002D2A000-memory.dmpFilesize
12.3MB
-
memory/1644-79-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/1644-80-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/1644-83-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/1644-90-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/1644-89-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1832-59-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1832-61-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1832-62-0x0000000004720000-0x00000000047AA000-memory.dmpFilesize
552KB
-
memory/1832-63-0x0000000004920000-0x0000000004961000-memory.dmpFilesize
260KB
-
memory/1832-64-0x00000000049D5000-0x00000000049E6000-memory.dmpFilesize
68KB