Analysis
- max time kernel
144s - max time network
149s - platform
windows10_x64 - resource
win10v20210410 - submitted
20/07/2021, 18:47
General
- Target Overdue payment_20218423384940404043.exe
- Size 616KB
- Sample210720-rmyje7ay8x
- SHA256 19247536d1bb8035395a3a2bca3ecb17c36ddf48fee86a00d9d6e3e4bf622f35
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Async RAT payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue payment_20218423384940404043.exe"C:\Users\Admin\AppData\Local\Temp\Overdue payment_20218423384940404043.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1904-135-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/1904-129-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3908-118-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/3908-126-0x0000000007220000-0x000000000728B000-memory.dmp
memory/3908-127-0x00000000072F0000-0x00000000072F1000-memory.dmp
memory/3908-121-0x0000000006FB0000-0x0000000006FB1000-memory.dmp
memory/3908-120-0x0000000005280000-0x00000000052C5000-memory.dmp
memory/3908-119-0x0000000004F60000-0x000000000545E000-memory.dmp
memory/3908-114-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/3908-117-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/3908-116-0x0000000005460000-0x0000000005461000-memory.dmp