Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-04-2021 01:06
Static task
static1
Behavioral task
behavioral1
Sample
7CA736BA6C5898C997FD82042EB2B4A3.exe
Resource
win7v20210408
General
-
Target
7CA736BA6C5898C997FD82042EB2B4A3.exe
-
Size
459KB
-
MD5
7ca736ba6c5898c997fd82042eb2b4a3
-
SHA1
258a71bd04ff5e3da545d941bb962de998fcb356
-
SHA256
a57e3df4a9633d46ac59b6a45a3ad21357acbf5182e841e16a820edf81138bb6
-
SHA512
6bf4d9251573d23de947f4ad3acba0162fdc748e7338eba6346201c09d48c4261105a3459132258fc6a22f3517ee1c3362c1c439d5287a50f4d2a48f23d10c16
Malware Config
Extracted
asyncrat
:
- aes_key
- anti_detection
- autorun
- bdos
- delay
- host
-
hwid
Write
- install_file
-
install_folder
xs4F7VPUmodOruvSvV.DMOM3d1QV9uxb9cuEw
- mutex
- pastebin_config
- port
- version
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
InstallUtil.exeInstallUtil.exeInstallUtil.exepid process 3348 InstallUtil.exe 3812 InstallUtil.exe 3432 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exedescription pid process target process PID 3656 set thread context of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exepowershell.exepid process 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe 2608 powershell.exe 2608 powershell.exe 2608 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 3432 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7CA736BA6C5898C997FD82042EB2B4A3.exedescription pid process target process PID 3656 wrote to memory of 2608 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 3656 wrote to memory of 2608 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 3656 wrote to memory of 2608 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe powershell.exe PID 3656 wrote to memory of 3348 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3348 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3348 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3812 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3812 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3812 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe PID 3656 wrote to memory of 3432 3656 7CA736BA6C5898C997FD82042EB2B4A3.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7CA736BA6C5898C997FD82042EB2B4A3.exe"C:\Users\Admin\AppData\Local\Temp\7CA736BA6C5898C997FD82042EB2B4A3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/2608-123-0x0000000000000000-mapping.dmp
-
memory/2608-145-0x00000000083F0000-0x00000000083F1000-memory.dmpFilesize
4KB
-
memory/2608-190-0x0000000004923000-0x0000000004924000-memory.dmpFilesize
4KB
-
memory/2608-189-0x000000007F120000-0x000000007F121000-memory.dmpFilesize
4KB
-
memory/2608-166-0x00000000096D0000-0x00000000096D1000-memory.dmpFilesize
4KB
-
memory/2608-126-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/2608-165-0x0000000009530000-0x0000000009531000-memory.dmpFilesize
4KB
-
memory/2608-160-0x00000000093C0000-0x00000000093C1000-memory.dmpFilesize
4KB
-
memory/2608-129-0x0000000007410000-0x0000000007411000-memory.dmpFilesize
4KB
-
memory/2608-153-0x0000000009400000-0x0000000009433000-memory.dmpFilesize
204KB
-
memory/2608-144-0x0000000008600000-0x0000000008601000-memory.dmpFilesize
4KB
-
memory/2608-143-0x0000000007B70000-0x0000000007B71000-memory.dmpFilesize
4KB
-
memory/2608-142-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/2608-136-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/2608-137-0x0000000004922000-0x0000000004923000-memory.dmpFilesize
4KB
-
memory/2608-141-0x0000000007C00000-0x0000000007C01000-memory.dmpFilesize
4KB
-
memory/2608-139-0x0000000007360000-0x0000000007361000-memory.dmpFilesize
4KB
-
memory/2608-140-0x0000000007A40000-0x0000000007A41000-memory.dmpFilesize
4KB
-
memory/3432-138-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3432-131-0x00000000004256FE-mapping.dmp
-
memory/3432-130-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3656-116-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/3656-117-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3656-120-0x0000000007F60000-0x0000000007FEA000-memory.dmpFilesize
552KB
-
memory/3656-118-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3656-119-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/3656-114-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/3656-122-0x0000000004A13000-0x0000000004A15000-memory.dmpFilesize
8KB
-
memory/3656-121-0x0000000008000000-0x0000000008041000-memory.dmpFilesize
260KB