Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 12:03
Static task
static1
Behavioral task
behavioral1
Sample
INV00293893.exe
Resource
win7v20210408
General
-
Target
INV00293893.exe
-
Size
593KB
-
MD5
9c697146c626141417666b847ba49752
-
SHA1
5847ac080a879df3533d5fece6cb21f07702beb3
-
SHA256
6d52d77cc1f4ae6384113a2099386a3ec22f31d6d58bb264d625d532fdf48161
-
SHA512
ba2f995e8d81227f96d6868bead1017960bfb18784691fb8e35754666794b7d10c6d7b8ae505e5d13fbfb23f55d44c232bfdc65890f8ee280b2835f0b5beb454
Malware Config
Extracted
asyncrat
0.5.7B
podzeye.duckdns.org:5522
podzeye.duckdns.org:5552
podzeye.duckdns.org:5533
AsyncMutex_6SI8OkPnk
-
aes_key
bvWieEm9xvjWPWmzbmFe0NuBHX1DCbdD
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
podzeye.duckdns.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
5522,5552,5533
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1168-125-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1168-126-0x000000000040C73E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV00293893.exedescription pid process target process PID 752 set thread context of 1168 752 INV00293893.exe INV00293893.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
INV00293893.exepid process 752 INV00293893.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
INV00293893.exedescription pid process Token: SeDebugPrivilege 752 INV00293893.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
INV00293893.exedescription pid process target process PID 752 wrote to memory of 3344 752 INV00293893.exe schtasks.exe PID 752 wrote to memory of 3344 752 INV00293893.exe schtasks.exe PID 752 wrote to memory of 3344 752 INV00293893.exe schtasks.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe PID 752 wrote to memory of 1168 752 INV00293893.exe INV00293893.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV00293893.exe"C:\Users\Admin\AppData\Local\Temp\INV00293893.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYkCZWtidw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41D7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INV00293893.exe"C:\Users\Admin\AppData\Local\Temp\INV00293893.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp41D7.tmpMD5
9512820a4c02319a9d4c400ace7a4fcc
SHA145bee9643b885e35e18cafd23ba0c4ace8573179
SHA256697ea901aa15dcaafed71f5390469f5d36ab42928edbacbdcb8d04c16812eadf
SHA512af5955fa43ddf17cdf0eb4b1e49dbc3854ece519a1a2d717aace00827db229a575a984a3f22bd2929ad4a724380154e6703426d87f7d4a347989d61d7bc4791e
-
memory/752-118-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/752-117-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/752-114-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/752-119-0x0000000005860000-0x000000000586E000-memory.dmpFilesize
56KB
-
memory/752-120-0x0000000006190000-0x0000000006191000-memory.dmpFilesize
4KB
-
memory/752-121-0x0000000002DD0000-0x0000000002E5A000-memory.dmpFilesize
552KB
-
memory/752-122-0x00000000015C0000-0x0000000001603000-memory.dmpFilesize
268KB
-
memory/752-116-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/1168-125-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1168-126-0x000000000040C73E-mapping.dmp
-
memory/1168-129-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3344-123-0x0000000000000000-mapping.dmp