Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-07-2021 07:19
Static task
static1
Behavioral task
behavioral1
Sample
PO-HDQ-52443-VTXOK-4584934.exe
Resource
win7v20210408
General
-
Target
PO-HDQ-52443-VTXOK-4584934.exe
-
Size
22KB
-
MD5
d458750e9eb89bd8f97fd365773eba31
-
SHA1
c8cae1c126bf03d79502698d9b90520be2bfcc36
-
SHA256
6979809578bc2caf8da003a70023e86d66cd9aa7e4b8c4448b942931a908583f
-
SHA512
64c33c69ad2653d24865a969ffff5cd351abf080e64d2189f95df211f7f657fa0b70454e45c97a6b557ba760e761ef4cd3426aca5c32e38f84d7c1c04cffc204
Malware Config
Extracted
asyncrat
0.5.6A
185.140.53.192:1515
grant123four5.ddns.net:1515
mewetkcokhrlmr
-
aes_key
2YCtMmTskUhh8TBzJJD3qNNyS40EuN7P
-
anti_detection
false
-
autorun
false
-
bdos
false
- delay
-
host
185.140.53.192,grant123four5.ddns.net
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
mewetkcokhrlmr
-
pastebin_config
null
-
port
1515
-
version
0.5.6A
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-128-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/3828-129-0x000000000040C3BE-mapping.dmp asyncrat -
Drops startup file 3 IoCs
Processes:
cmd.exePO-HDQ-52443-VTXOK-4584934.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exedescription pid process target process PID 568 set thread context of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exePO-HDQ-52443-VTXOK-4584934.exepid process 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 568 PO-HDQ-52443-VTXOK-4584934.exe 3828 PO-HDQ-52443-VTXOK-4584934.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exePO-HDQ-52443-VTXOK-4584934.exedescription pid process Token: SeDebugPrivilege 568 PO-HDQ-52443-VTXOK-4584934.exe Token: SeDebugPrivilege 3828 PO-HDQ-52443-VTXOK-4584934.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PO-HDQ-52443-VTXOK-4584934.exedescription pid process target process PID 568 wrote to memory of 2784 568 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 568 wrote to memory of 2784 568 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 568 wrote to memory of 2784 568 PO-HDQ-52443-VTXOK-4584934.exe cmd.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe PID 568 wrote to memory of 3828 568 PO-HDQ-52443-VTXOK-4584934.exe PO-HDQ-52443-VTXOK-4584934.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"C:\Users\Admin\AppData\Local\Temp\PO-HDQ-52443-VTXOK-4584934.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-HDQ-52443-VTXOK-4584934.exe.logMD5
59c8376eaaeb2974da0807abc9acd83d
SHA1805b226be7b7c8e393f93cd72cdd7ca7c1d61fc5
SHA256e5dabd59477c0a28735ba8303d2bc3a20435534a2d97d6c3d1a9f68a217a5acc
SHA512a5a3fe3ad86c98e04e7927827acbfd25ab1371f158e70750f0b4abee07119543ec9bfc041827289bd2f2c2fe1e9086403b483ca345aadb38338309b4800597aa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-HDQ-52443-VTXOK-4584934.exeMD5
d458750e9eb89bd8f97fd365773eba31
SHA1c8cae1c126bf03d79502698d9b90520be2bfcc36
SHA2566979809578bc2caf8da003a70023e86d66cd9aa7e4b8c4448b942931a908583f
SHA51264c33c69ad2653d24865a969ffff5cd351abf080e64d2189f95df211f7f657fa0b70454e45c97a6b557ba760e761ef4cd3426aca5c32e38f84d7c1c04cffc204
-
memory/568-123-0x0000000006510000-0x0000000006511000-memory.dmpFilesize
4KB
-
memory/568-127-0x0000000006470000-0x000000000650C000-memory.dmpFilesize
624KB
-
memory/568-119-0x0000000004F90000-0x000000000548E000-memory.dmpFilesize
5.0MB
-
memory/568-120-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/568-121-0x0000000005460000-0x0000000005478000-memory.dmpFilesize
96KB
-
memory/568-122-0x0000000006230000-0x0000000006231000-memory.dmpFilesize
4KB
-
memory/568-114-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/568-116-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/568-125-0x0000000006620000-0x0000000006621000-memory.dmpFilesize
4KB
-
memory/568-117-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/568-118-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/2784-124-0x0000000000000000-mapping.dmp
-
memory/3828-128-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3828-129-0x000000000040C3BE-mapping.dmp
-
memory/3828-133-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB