Analysis
-
max time kernel
111s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 03:51
Static task
static1
Behavioral task
behavioral1
Sample
85c122363fe6ee91cdcdf8c3d307b75d.exe
Resource
win7v20210410
General
-
Target
85c122363fe6ee91cdcdf8c3d307b75d.exe
-
Size
22KB
-
MD5
85c122363fe6ee91cdcdf8c3d307b75d
-
SHA1
5a302331f5264923c3e5bccd79bd17403c4dc6e7
-
SHA256
c2576e9e401ba6b3716d78e8cc64a17f513c68592fd7897ddf709c4e9454aaa8
-
SHA512
84b18ace3a24e27e4fb67444c61e5abc11762e6a4732bd4b0547247a971d3700070e5cefd46e945ec823e2bc7680ba2fb985c9832ee5fd64b64ddcc1c41f3d03
Malware Config
Extracted
asyncrat
0.5.7B
38.132.99.156:6606
38.132.99.156:7707
38.132.99.156:8808
thewatersmoney.hopto.org:6606
thewatersmoney.hopto.org:7707
thewatersmoney.hopto.org:8808
AsyncMutex_6SI8OkPnk
-
aes_key
iJSacvzCWPl1LYxGZUA2LWWvKIcJOBSR
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
38.132.99.156,thewatersmoney.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1668-66-0x000000000040C76E-mapping.dmp asyncrat behavioral1/memory/1668-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1668-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exepid process 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exedescription pid process target process PID 1748 set thread context of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1112 1748 WerFault.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1724 timeout.exe -
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exeWerFault.exepid process 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1112 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exeWerFault.exe85c122363fe6ee91cdcdf8c3d307b75d.exedescription pid process Token: SeDebugPrivilege 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe Token: SeDebugPrivilege 1112 WerFault.exe Token: SeDebugPrivilege 1668 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.execmd.exedescription pid process target process PID 1748 wrote to memory of 1312 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1748 wrote to memory of 1312 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1748 wrote to memory of 1312 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1748 wrote to memory of 1312 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1312 wrote to memory of 1724 1312 cmd.exe timeout.exe PID 1312 wrote to memory of 1724 1312 cmd.exe timeout.exe PID 1312 wrote to memory of 1724 1312 cmd.exe timeout.exe PID 1312 wrote to memory of 1724 1312 cmd.exe timeout.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1668 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1748 wrote to memory of 1112 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe WerFault.exe PID 1748 wrote to memory of 1112 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe WerFault.exe PID 1748 wrote to memory of 1112 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe WerFault.exe PID 1748 wrote to memory of 1112 1748 85c122363fe6ee91cdcdf8c3d307b75d.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 17402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
e82a56a7f575061934fa337954516da4
SHA1ea748e7410f23ab759878ccf714ec4c940bb17a4
SHA256d109e9f9026b132b74fa6c10b0392177207e4b63068ca1604aa54911f598462a
SHA5125e315311885a41e8002134f900b5b8af33200e30913ed0002c2da03d0ef990178f61eae367dbd2d411450882b78328b7874be422daba3b7694db8e7a3603ca63
-
memory/1112-69-0x0000000000000000-mapping.dmp
-
memory/1112-70-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/1312-63-0x0000000000000000-mapping.dmp
-
memory/1668-66-0x000000000040C76E-mapping.dmp
-
memory/1668-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1668-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1668-71-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/1724-64-0x0000000000000000-mapping.dmp
-
memory/1748-59-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/1748-61-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/1748-62-0x0000000000AD0000-0x0000000000AF9000-memory.dmpFilesize
164KB