Analysis
-
max time kernel
23s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 16:05
Behavioral task
behavioral1
Sample
04d0649b4bfa1dfeae3a8c86453397a3.exe
Resource
win7v20210408
General
-
Target
04d0649b4bfa1dfeae3a8c86453397a3.exe
-
Size
45KB
-
MD5
04d0649b4bfa1dfeae3a8c86453397a3
-
SHA1
f47a6585df4bbb264017cacbb11a2d0e88fcea84
-
SHA256
26b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
-
SHA512
e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
Malware Config
Extracted
asyncrat
0.5.7B
8.tcp.ngrok.io:18318
AsyncMutex_6SI8OkPnk
-
aes_key
v4WrWlQmMr9Nbg46PqpYZ1ZQie6iSq6f
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
8.tcp.ngrok.io
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
18318
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1668 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1640 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 992 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.exepid process 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.exesvchost.exedescription pid process Token: SeDebugPrivilege 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe Token: SeDebugPrivilege 1668 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.execmd.execmd.exedescription pid process target process PID 1840 wrote to memory of 1700 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1700 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1700 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1700 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1640 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1640 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1640 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1840 wrote to memory of 1640 1840 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 1700 wrote to memory of 1676 1700 cmd.exe schtasks.exe PID 1700 wrote to memory of 1676 1700 cmd.exe schtasks.exe PID 1700 wrote to memory of 1676 1700 cmd.exe schtasks.exe PID 1700 wrote to memory of 1676 1700 cmd.exe schtasks.exe PID 1640 wrote to memory of 992 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 992 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 992 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 992 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 1668 1640 cmd.exe svchost.exe PID 1640 wrote to memory of 1668 1640 cmd.exe svchost.exe PID 1640 wrote to memory of 1668 1640 cmd.exe svchost.exe PID 1640 wrote to memory of 1668 1640 cmd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d0649b4bfa1dfeae3a8c86453397a3.exe"C:\Users\Admin\AppData\Local\Temp\04d0649b4bfa1dfeae3a8c86453397a3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB07B.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB07B.tmp.batMD5
a08854db2274ea2de14a7d1b4692ef55
SHA136b6c6039e2a559181fe1e9e0b81929af2837112
SHA25611aa9fab002815dff654ff0609959814ca0babab57e4348606712e0e0be5b3d3
SHA51211a774ad5e3f85b65ea4eb80ba1e91c0d860b2a00ed6e0ac011cd26e02fa6f731a236138234b8e8aba57bb25d019d1db2a29463662768e313cb201b5683090d8
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
04d0649b4bfa1dfeae3a8c86453397a3
SHA1f47a6585df4bbb264017cacbb11a2d0e88fcea84
SHA25626b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
SHA512e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
04d0649b4bfa1dfeae3a8c86453397a3
SHA1f47a6585df4bbb264017cacbb11a2d0e88fcea84
SHA25626b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
SHA512e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
-
\Users\Admin\AppData\Roaming\svchost.exeMD5
04d0649b4bfa1dfeae3a8c86453397a3
SHA1f47a6585df4bbb264017cacbb11a2d0e88fcea84
SHA25626b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
SHA512e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
-
memory/992-68-0x0000000000000000-mapping.dmp
-
memory/1640-65-0x0000000000000000-mapping.dmp
-
memory/1668-71-0x0000000000000000-mapping.dmp
-
memory/1668-73-0x00000000012C0000-0x00000000012C1000-memory.dmpFilesize
4KB
-
memory/1668-76-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1676-66-0x0000000000000000-mapping.dmp
-
memory/1700-64-0x0000000000000000-mapping.dmp
-
memory/1840-63-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1840-62-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1840-60-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB