Analysis
-
max time kernel
120s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 16:05
Behavioral task
behavioral1
Sample
04d0649b4bfa1dfeae3a8c86453397a3.exe
Resource
win7v20210408
General
-
Target
04d0649b4bfa1dfeae3a8c86453397a3.exe
-
Size
45KB
-
MD5
04d0649b4bfa1dfeae3a8c86453397a3
-
SHA1
f47a6585df4bbb264017cacbb11a2d0e88fcea84
-
SHA256
26b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
-
SHA512
e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
Malware Config
Extracted
asyncrat
0.5.7B
8.tcp.ngrok.io:18318
AsyncMutex_6SI8OkPnk
-
aes_key
v4WrWlQmMr9Nbg46PqpYZ1ZQie6iSq6f
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
8.tcp.ngrok.io
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
18318
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3888 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3592 timeout.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.exepid process 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe 584 04d0649b4bfa1dfeae3a8c86453397a3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.exesvchost.exedescription pid process Token: SeDebugPrivilege 584 04d0649b4bfa1dfeae3a8c86453397a3.exe Token: SeDebugPrivilege 3888 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
04d0649b4bfa1dfeae3a8c86453397a3.execmd.execmd.exedescription pid process target process PID 584 wrote to memory of 960 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 584 wrote to memory of 960 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 584 wrote to memory of 960 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 584 wrote to memory of 1252 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 584 wrote to memory of 1252 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 584 wrote to memory of 1252 584 04d0649b4bfa1dfeae3a8c86453397a3.exe cmd.exe PID 960 wrote to memory of 1264 960 cmd.exe schtasks.exe PID 960 wrote to memory of 1264 960 cmd.exe schtasks.exe PID 960 wrote to memory of 1264 960 cmd.exe schtasks.exe PID 1252 wrote to memory of 3592 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 3592 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 3592 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 3888 1252 cmd.exe svchost.exe PID 1252 wrote to memory of 3888 1252 cmd.exe svchost.exe PID 1252 wrote to memory of 3888 1252 cmd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d0649b4bfa1dfeae3a8c86453397a3.exe"C:\Users\Admin\AppData\Local\Temp\04d0649b4bfa1dfeae3a8c86453397a3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9197.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9197.tmp.batMD5
f1e81d3cadd3e4ce743de22fe8d21b9d
SHA17b9d05ab788e0ead99343c4a183244fc75f5a012
SHA256c938c5da7e9a941f266cc4265d0e1550344bf03f2e4cafe15f61f36b0cea19b8
SHA51203c62721614fb92b5469d0f1c66a34ce50334e3fd5a302b8daa61801c99178086ace56229479a004aad0eb4d4e0211c442b08b86535ebb5328a92dc94f1cced3
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
04d0649b4bfa1dfeae3a8c86453397a3
SHA1f47a6585df4bbb264017cacbb11a2d0e88fcea84
SHA25626b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
SHA512e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
04d0649b4bfa1dfeae3a8c86453397a3
SHA1f47a6585df4bbb264017cacbb11a2d0e88fcea84
SHA25626b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870
SHA512e2c7ab0d8b80f3b2ae4369177d654011b75cd288e855724cee2dd64af45dff81e12d5a5ba72c075c6d48291f79b83a3cf120c068c90f01ddf36e5ae88901ab68
-
memory/584-116-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/584-117-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/584-114-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/960-118-0x0000000000000000-mapping.dmp
-
memory/1252-119-0x0000000000000000-mapping.dmp
-
memory/1264-121-0x0000000000000000-mapping.dmp
-
memory/3592-122-0x0000000000000000-mapping.dmp
-
memory/3888-123-0x0000000000000000-mapping.dmp
-
memory/3888-128-0x0000000005701000-0x0000000005702000-memory.dmpFilesize
4KB
-
memory/3888-130-0x00000000064F0000-0x00000000064F1000-memory.dmpFilesize
4KB
-
memory/3888-131-0x0000000005FF0000-0x0000000005FF1000-memory.dmpFilesize
4KB