Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-04-2021 10:52
Static task
static1
Behavioral task
behavioral1
Sample
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
Resource
win7v20210410
General
-
Target
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
-
Size
31KB
-
MD5
a8342cc8da869ef50d515c763355f7e7
-
SHA1
09c2016d87e1eec27d074f9f91ffcd327cee6765
-
SHA256
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e
-
SHA512
d2d4e8d4d9298bba81c86e88b390caf1149d0dc1fe8da09667357a4215d83cd672a2aa10ae24207dea25ceaf831c4b3a51c6c23003c4d13d2ab88dbcfa46bde1
Malware Config
Extracted
asyncrat
0.5.7B
38.132.99.156:6606
38.132.99.156:7707
38.132.99.156:8808
thewatersmoney.hopto.org:6606
thewatersmoney.hopto.org:7707
thewatersmoney.hopto.org:8808
AsyncMutex_6SI8OkPnk
-
aes_key
7rQQflcP9GKgHFrUqTCHhu5LwhPUSqyV
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
38.132.99.156,thewatersmoney.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1516-68-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1516-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1516-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exepid process 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription pid process target process PID 1052 set thread context of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 240 timeout.exe -
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exepid process 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription pid process Token: SeDebugPrivilege 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Token: SeDebugPrivilege 1516 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.execmd.exedescription pid process target process PID 1052 wrote to memory of 1364 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 1052 wrote to memory of 1364 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 1052 wrote to memory of 1364 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 1052 wrote to memory of 1364 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 1364 wrote to memory of 240 1364 cmd.exe timeout.exe PID 1364 wrote to memory of 240 1364 cmd.exe timeout.exe PID 1364 wrote to memory of 240 1364 cmd.exe timeout.exe PID 1364 wrote to memory of 240 1364 cmd.exe timeout.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 1052 wrote to memory of 1516 1052 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
8fedf52bec30d11c1ade38803cbe2654
SHA102c8975d69b22beade3d44dce850354dbf27c672
SHA256b69607fc59db2d3971bc7d14c1d8964738a6ea6ef589312832665d08494510a1
SHA512a21ffcdb08731396424711af2671f422a760f4c2e4f6e4e8c488cedb76a90ed1fbaefba69cb6a8598f1df11f4d19e14452fe106381e8a0e7fe4ff3d6f00b5f5e
-
memory/240-66-0x0000000000000000-mapping.dmp
-
memory/1052-60-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/1052-62-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1052-63-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/1052-64-0x0000000000A00000-0x0000000000A29000-memory.dmpFilesize
164KB
-
memory/1364-65-0x0000000000000000-mapping.dmp
-
memory/1516-68-0x000000000040C75E-mapping.dmp
-
memory/1516-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1516-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1516-72-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB