Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 12:01
Behavioral task
behavioral1
Sample
1ab91c6b55ef7fe9426448d1b365e919.exe
Resource
win7v20210410
General
-
Target
1ab91c6b55ef7fe9426448d1b365e919.exe
-
Size
47KB
-
MD5
1ab91c6b55ef7fe9426448d1b365e919
-
SHA1
a47527efb62e08131fadd1c0c321d1405688acde
-
SHA256
0953e07352cc9da191595f0dc233d4c04070b507f3503cf7cd62e6bb9a680ec7
-
SHA512
bf940cda054dcf7a117296dfec96683ad3b6b1d0a431caa171741630145df33d6f57f30b647c8fbbd04648fc716fba9ca78a673398b522e06b3a37a489a0c87f
Malware Config
Extracted
asyncrat
0.5.7B
cryptserver.hopto.org:4444
AsyncMutex_6SI8OkPnk
-
aes_key
eT1fq0d6dtymBNAUb6WLtqX26xciO5Sd
-
anti_detection
true
-
autorun
true
-
bdos
false
-
delay
Default
-
host
cryptserver.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
4444
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\update.exe asyncrat C:\Users\Admin\AppData\Roaming\update.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
update.exepid process 2248 update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1228 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
1ab91c6b55ef7fe9426448d1b365e919.exepid process 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe 736 1ab91c6b55ef7fe9426448d1b365e919.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1ab91c6b55ef7fe9426448d1b365e919.exeupdate.exedescription pid process Token: SeDebugPrivilege 736 1ab91c6b55ef7fe9426448d1b365e919.exe Token: SeDebugPrivilege 2248 update.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1ab91c6b55ef7fe9426448d1b365e919.execmd.execmd.exedescription pid process target process PID 736 wrote to memory of 4068 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 736 wrote to memory of 4068 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 736 wrote to memory of 4068 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 736 wrote to memory of 2732 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 736 wrote to memory of 2732 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 736 wrote to memory of 2732 736 1ab91c6b55ef7fe9426448d1b365e919.exe cmd.exe PID 4068 wrote to memory of 1184 4068 cmd.exe schtasks.exe PID 4068 wrote to memory of 1184 4068 cmd.exe schtasks.exe PID 4068 wrote to memory of 1184 4068 cmd.exe schtasks.exe PID 2732 wrote to memory of 1228 2732 cmd.exe timeout.exe PID 2732 wrote to memory of 1228 2732 cmd.exe timeout.exe PID 2732 wrote to memory of 1228 2732 cmd.exe timeout.exe PID 2732 wrote to memory of 2248 2732 cmd.exe update.exe PID 2732 wrote to memory of 2248 2732 cmd.exe update.exe PID 2732 wrote to memory of 2248 2732 cmd.exe update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ab91c6b55ef7fe9426448d1b365e919.exe"C:\Users\Admin\AppData\Local\Temp\1ab91c6b55ef7fe9426448d1b365e919.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC4FB.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC4FB.tmp.batMD5
35233e36c3099247d87111a3afe2a950
SHA10455eb10692660909d157054a718c8765be83bc4
SHA256b63e4c27f5934094c8ae3bce48236d0a5467accc08c03f49a51b9a34d5b9d6ed
SHA512540800e1bfaa463038bd8b675204566104dda117ac6f1cadeed888371fd39f3bd6d1fc163b2c616cf78238613e30df1a1dd8f3b07b30e1e51f3ae09f2c97ee98
-
C:\Users\Admin\AppData\Roaming\update.exeMD5
1ab91c6b55ef7fe9426448d1b365e919
SHA1a47527efb62e08131fadd1c0c321d1405688acde
SHA2560953e07352cc9da191595f0dc233d4c04070b507f3503cf7cd62e6bb9a680ec7
SHA512bf940cda054dcf7a117296dfec96683ad3b6b1d0a431caa171741630145df33d6f57f30b647c8fbbd04648fc716fba9ca78a673398b522e06b3a37a489a0c87f
-
C:\Users\Admin\AppData\Roaming\update.exeMD5
1ab91c6b55ef7fe9426448d1b365e919
SHA1a47527efb62e08131fadd1c0c321d1405688acde
SHA2560953e07352cc9da191595f0dc233d4c04070b507f3503cf7cd62e6bb9a680ec7
SHA512bf940cda054dcf7a117296dfec96683ad3b6b1d0a431caa171741630145df33d6f57f30b647c8fbbd04648fc716fba9ca78a673398b522e06b3a37a489a0c87f
-
memory/736-117-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/736-118-0x0000000005CC0000-0x0000000005CC1000-memory.dmpFilesize
4KB
-
memory/736-116-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/736-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/1184-122-0x0000000000000000-mapping.dmp
-
memory/1228-123-0x0000000000000000-mapping.dmp
-
memory/2248-124-0x0000000000000000-mapping.dmp
-
memory/2248-129-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/2732-120-0x0000000000000000-mapping.dmp
-
memory/4068-119-0x0000000000000000-mapping.dmp