Analysis
- max time kernel
43s - max time network
149s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/05/2021, 12:16
General
- Target 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
- Size 203KB
- Sample210504-h9saadlekn
- SHA256 6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe"C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2204-121-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/2204-118-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/2204-119-0x0000000007110000-0x0000000007111000-memory.dmp
memory/2204-120-0x0000000006870000-0x00000000068B0000-memory.dmp
memory/2204-114-0x0000000000560000-0x0000000000561000-memory.dmp
memory/2204-122-0x0000000006910000-0x0000000006911000-memory.dmp
memory/2204-117-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/2204-116-0x0000000005300000-0x0000000005301000-memory.dmp
memory/3956-123-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3956-129-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/3956-131-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/3956-132-0x0000000005070000-0x0000000005071000-memory.dmp