Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14-07-2021 06:34
Static task
static1
Behavioral task
behavioral1
Sample
a208dc9a774f7ca9f5b258267183953b.exe
Resource
win7v20210408
General
-
Target
a208dc9a774f7ca9f5b258267183953b.exe
-
Size
524KB
-
MD5
a208dc9a774f7ca9f5b258267183953b
-
SHA1
c1d5ccda7b0dcd9fad25b88123a7158b417fc698
-
SHA256
07afaa692f9b826c080cd9b1dc846bb8d6dc5404710241012f5c067d464692d3
-
SHA512
90f0147436afabc9e8a7177b75982d9c146b25a766a46f8ca33a7e2bc3be87d8536a8bdfa839c3a6e9a079486079632c2ee97b1af33c2ba9c248c97ecf59b4ca
Malware Config
Extracted
asyncrat
0.5.7B
37.0.11.45:1604
37.0.11.45:3162
37.0.11.45:9495
37.0.11.45:448
AsyncMutex_6SI8OkPnk
-
aes_key
pKLwmhjVAyNL9HzHN02o82BM56qjUmJq
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
taskk
-
host
37.0.11.45
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
1604,3162,9495,448
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1004-126-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1004-127-0x000000000040C70E-mapping.dmp asyncrat behavioral2/memory/1004-142-0x0000000006C30000-0x0000000006C4B000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a208dc9a774f7ca9f5b258267183953b.exedescription pid process target process PID 1696 set thread context of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a208dc9a774f7ca9f5b258267183953b.exeRegSvcs.exepid process 1696 a208dc9a774f7ca9f5b258267183953b.exe 1004 RegSvcs.exe 1004 RegSvcs.exe 1004 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a208dc9a774f7ca9f5b258267183953b.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1696 a208dc9a774f7ca9f5b258267183953b.exe Token: SeDebugPrivilege 1004 RegSvcs.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
a208dc9a774f7ca9f5b258267183953b.exeRegSvcs.execmd.execmd.execmd.exedescription pid process target process PID 1696 wrote to memory of 2296 1696 a208dc9a774f7ca9f5b258267183953b.exe schtasks.exe PID 1696 wrote to memory of 2296 1696 a208dc9a774f7ca9f5b258267183953b.exe schtasks.exe PID 1696 wrote to memory of 2296 1696 a208dc9a774f7ca9f5b258267183953b.exe schtasks.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1696 wrote to memory of 1004 1696 a208dc9a774f7ca9f5b258267183953b.exe RegSvcs.exe PID 1004 wrote to memory of 4016 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 4016 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 4016 1004 RegSvcs.exe cmd.exe PID 4016 wrote to memory of 3956 4016 cmd.exe powershell.exe PID 4016 wrote to memory of 3956 4016 cmd.exe powershell.exe PID 4016 wrote to memory of 3956 4016 cmd.exe powershell.exe PID 1004 wrote to memory of 2072 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 2072 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 2072 1004 RegSvcs.exe cmd.exe PID 2072 wrote to memory of 3860 2072 cmd.exe powershell.exe PID 2072 wrote to memory of 3860 2072 cmd.exe powershell.exe PID 2072 wrote to memory of 3860 2072 cmd.exe powershell.exe PID 1004 wrote to memory of 1460 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 1460 1004 RegSvcs.exe cmd.exe PID 1004 wrote to memory of 1460 1004 RegSvcs.exe cmd.exe PID 1460 wrote to memory of 2360 1460 cmd.exe powershell.exe PID 1460 wrote to memory of 2360 1460 cmd.exe powershell.exe PID 1460 wrote to memory of 2360 1460 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a208dc9a774f7ca9f5b258267183953b.exe"C:\Users\Admin\AppData\Local\Temp\a208dc9a774f7ca9f5b258267183953b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\orRYrJhV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp746A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\epfevf.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\epfevf.exe"'4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mtbxpq.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mtbxpq.exe"'4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lkjveq.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lkjveq.exe"'4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp746A.tmpMD5
6ebf9a72b8d6735866a8bb9a1b72f57e
SHA123c6f17f8588046ed8df60cf5ebeea8650150685
SHA2567755003b6711f1c263e7d4f7f3c11dda01778a0d16fe0b936ce9eb0c178b7a57
SHA51216f025b615251c75c87dc75f5a79462bb0ddb3d9dff4bd2ae016c3c74483d4d84358c8e47d467156a0d5bce61fdb63d36c8f5fd2bcf434a5925e85673e462c6b
-
memory/1004-140-0x00000000071C0000-0x0000000007219000-memory.dmpFilesize
356KB
-
memory/1004-139-0x0000000007030000-0x00000000070BD000-memory.dmpFilesize
564KB
-
memory/1004-134-0x0000000006AA0000-0x0000000006AA1000-memory.dmpFilesize
4KB
-
memory/1004-133-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/1004-135-0x0000000006A20000-0x0000000006A99000-memory.dmpFilesize
484KB
-
memory/1004-142-0x0000000006C30000-0x0000000006C4B000-memory.dmpFilesize
108KB
-
memory/1004-141-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/1004-127-0x000000000040C70E-mapping.dmp
-
memory/1004-138-0x0000000006BE0000-0x0000000006BE4000-memory.dmpFilesize
16KB
-
memory/1004-137-0x0000000006C70000-0x0000000006C71000-memory.dmpFilesize
4KB
-
memory/1004-126-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1004-136-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/1004-130-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/1460-151-0x0000000000000000-mapping.dmp
-
memory/1696-120-0x0000000006A00000-0x0000000006A01000-memory.dmpFilesize
4KB
-
memory/1696-118-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/1696-116-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1696-117-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1696-123-0x000000000AF50000-0x000000000AF7D000-memory.dmpFilesize
180KB
-
memory/1696-114-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1696-122-0x00000000087D0000-0x000000000884D000-memory.dmpFilesize
500KB
-
memory/1696-121-0x0000000006980000-0x0000000006982000-memory.dmpFilesize
8KB
-
memory/1696-119-0x0000000004D70000-0x000000000526E000-memory.dmpFilesize
5.0MB
-
memory/2072-147-0x0000000000000000-mapping.dmp
-
memory/2296-124-0x0000000000000000-mapping.dmp
-
memory/2360-152-0x0000000000000000-mapping.dmp
-
memory/3860-148-0x0000000000000000-mapping.dmp
-
memory/3956-145-0x0000000000000000-mapping.dmp
-
memory/4016-144-0x0000000000000000-mapping.dmp