Analysis
-
max time kernel
18s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-04-2021 10:52
Static task
static1
Behavioral task
behavioral1
Sample
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
Resource
win7v20210410
General
-
Target
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
-
Size
31KB
-
MD5
a8342cc8da869ef50d515c763355f7e7
-
SHA1
09c2016d87e1eec27d074f9f91ffcd327cee6765
-
SHA256
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e
-
SHA512
d2d4e8d4d9298bba81c86e88b390caf1149d0dc1fe8da09667357a4215d83cd672a2aa10ae24207dea25ceaf831c4b3a51c6c23003c4d13d2ab88dbcfa46bde1
Malware Config
Extracted
asyncrat
0.5.7B
38.132.99.156:6606
38.132.99.156:7707
38.132.99.156:8808
thewatersmoney.hopto.org:6606
thewatersmoney.hopto.org:7707
thewatersmoney.hopto.org:8808
AsyncMutex_6SI8OkPnk
-
aes_key
7rQQflcP9GKgHFrUqTCHhu5LwhPUSqyV
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
38.132.99.156,thewatersmoney.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1368-122-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1368-123-0x000000000040C75E-mapping.dmp asyncrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exepid process 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription pid process target process PID 776 set thread context of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3988 776 WerFault.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2384 timeout.exe -
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exeWerFault.exepid process 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe 3988 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exeWerFault.exe8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exedescription pid process Token: SeDebugPrivilege 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe Token: SeRestorePrivilege 3988 WerFault.exe Token: SeBackupPrivilege 3988 WerFault.exe Token: SeDebugPrivilege 3988 WerFault.exe Token: SeDebugPrivilege 1368 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.execmd.exedescription pid process target process PID 776 wrote to memory of 2024 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 776 wrote to memory of 2024 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 776 wrote to memory of 2024 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe cmd.exe PID 2024 wrote to memory of 2384 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 2384 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 2384 2024 cmd.exe timeout.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe PID 776 wrote to memory of 1368 776 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe 8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"C:\Users\Admin\AppData\Local\Temp\8ad036d5f41579768454931925f1a273c98834a033507154f1db95f962dfd45e.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 25722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-114-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/776-116-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/776-117-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/776-118-0x0000000005F10000-0x0000000005F11000-memory.dmpFilesize
4KB
-
memory/776-119-0x0000000002280000-0x00000000022A9000-memory.dmpFilesize
164KB
-
memory/1368-122-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1368-123-0x000000000040C75E-mapping.dmp
-
memory/1368-126-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/1368-129-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/2024-120-0x0000000000000000-mapping.dmp
-
memory/2384-121-0x0000000000000000-mapping.dmp