Analysis
-
max time kernel
16s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 03:51
Static task
static1
Behavioral task
behavioral1
Sample
85c122363fe6ee91cdcdf8c3d307b75d.exe
Resource
win7v20210410
General
-
Target
85c122363fe6ee91cdcdf8c3d307b75d.exe
-
Size
22KB
-
MD5
85c122363fe6ee91cdcdf8c3d307b75d
-
SHA1
5a302331f5264923c3e5bccd79bd17403c4dc6e7
-
SHA256
c2576e9e401ba6b3716d78e8cc64a17f513c68592fd7897ddf709c4e9454aaa8
-
SHA512
84b18ace3a24e27e4fb67444c61e5abc11762e6a4732bd4b0547247a971d3700070e5cefd46e945ec823e2bc7680ba2fb985c9832ee5fd64b64ddcc1c41f3d03
Malware Config
Extracted
asyncrat
0.5.7B
38.132.99.156:6606
38.132.99.156:7707
38.132.99.156:8808
thewatersmoney.hopto.org:6606
thewatersmoney.hopto.org:7707
thewatersmoney.hopto.org:8808
AsyncMutex_6SI8OkPnk
-
aes_key
iJSacvzCWPl1LYxGZUA2LWWvKIcJOBSR
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
38.132.99.156,thewatersmoney.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2180-122-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2180-123-0x000000000040C76E-mapping.dmp asyncrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exepid process 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exedescription pid process target process PID 1000 set thread context of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1472 1000 WerFault.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2060 timeout.exe -
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exeWerFault.exepid process 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.exeWerFault.exe85c122363fe6ee91cdcdf8c3d307b75d.exedescription pid process Token: SeDebugPrivilege 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe Token: SeRestorePrivilege 1472 WerFault.exe Token: SeBackupPrivilege 1472 WerFault.exe Token: SeDebugPrivilege 1472 WerFault.exe Token: SeDebugPrivilege 2180 85c122363fe6ee91cdcdf8c3d307b75d.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
85c122363fe6ee91cdcdf8c3d307b75d.execmd.exedescription pid process target process PID 1000 wrote to memory of 204 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1000 wrote to memory of 204 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 1000 wrote to memory of 204 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe cmd.exe PID 204 wrote to memory of 2060 204 cmd.exe timeout.exe PID 204 wrote to memory of 2060 204 cmd.exe timeout.exe PID 204 wrote to memory of 2060 204 cmd.exe timeout.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe PID 1000 wrote to memory of 2180 1000 85c122363fe6ee91cdcdf8c3d307b75d.exe 85c122363fe6ee91cdcdf8c3d307b75d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"C:\Users\Admin\AppData\Local\Temp\85c122363fe6ee91cdcdf8c3d307b75d.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 25202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-120-0x0000000000000000-mapping.dmp
-
memory/1000-114-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/1000-116-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/1000-117-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/1000-118-0x0000000006170000-0x0000000006171000-memory.dmpFilesize
4KB
-
memory/1000-119-0x0000000004730000-0x0000000004759000-memory.dmpFilesize
164KB
-
memory/2060-121-0x0000000000000000-mapping.dmp
-
memory/2180-122-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2180-123-0x000000000040C76E-mapping.dmp
-
memory/2180-126-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/2180-129-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB