Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 07:19
Static task
static1
Behavioral task
behavioral1
Sample
PO-HDQ-52443-VTXOK-4584934.exe
Resource
win7v20210408
General
-
Target
PO-HDQ-52443-VTXOK-4584934.exe
-
Size
22KB
-
MD5
d458750e9eb89bd8f97fd365773eba31
-
SHA1
c8cae1c126bf03d79502698d9b90520be2bfcc36
-
SHA256
6979809578bc2caf8da003a70023e86d66cd9aa7e4b8c4448b942931a908583f
-
SHA512
64c33c69ad2653d24865a969ffff5cd351abf080e64d2189f95df211f7f657fa0b70454e45c97a6b557ba760e761ef4cd3426aca5c32e38f84d7c1c04cffc204
Malware Config
Extracted
asyncrat
0.5.6A
185.140.53.192:1515
grant123four5.ddns.net:1515
mewetkcokhrlmr
-
aes_key
2YCtMmTskUhh8TBzJJD3qNNyS40EuN7P
-
anti_detection
false
-
autorun
false
-
bdos
false
- delay
-
host
185.140.53.192,grant123four5.ddns.net
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
mewetkcokhrlmr
-
pastebin_config
null
-
port
1515
-
version
0.5.6A
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/984-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/984-67-0x000000000040C3BE-mapping.dmp asyncrat behavioral1/memory/984-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Drops startup file 3 IoCs
Processes:
cmd.exePO-HDQ-52443-VTXOK-4584934.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exedescription pid process target process PID 1832 set thread context of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exePO-HDQ-52443-VTXOK-4584934.exepid process 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 1832 PO-HDQ-52443-VTXOK-4584934.exe 984 PO-HDQ-52443-VTXOK-4584934.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exePO-HDQ-52443-VTXOK-4584934.exedescription pid process Token: SeDebugPrivilege 1832 PO-HDQ-52443-VTXOK-4584934.exe Token: SeDebugPrivilege 984 PO-HDQ-52443-VTXOK-4584934.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exedescription pid process target process PID 1832 wrote to memory of 1640 1832 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 1832 wrote to memory of 1640 1832 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 1832 wrote to memory of 1640 1832 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 1832 wrote to memory of 1640 1832 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 1832 wrote to memory of 984 1832 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exeMD5
d458750e9eb89bd8f97fd365773eba31
SHA1c8cae1c126bf03d79502698d9b90520be2bfcc36
SHA2566979809578bc2caf8da003a70023e86d66cd9aa7e4b8c4448b942931a908583f
SHA51264c33c69ad2653d24865a969ffff5cd351abf080e64d2189f95df211f7f657fa0b70454e45c97a6b557ba760e761ef4cd3426aca5c32e38f84d7c1c04cffc204
-
memory/984-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/984-67-0x000000000040C3BE-mapping.dmp
-
memory/984-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/984-70-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/984-71-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1640-63-0x0000000000000000-mapping.dmp
-
memory/1832-59-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/1832-61-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/1832-62-0x0000000000490000-0x00000000004A8000-memory.dmpFilesize
96KB
-
memory/1832-65-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB