Analysis
-
max time kernel
21s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-07-2021 14:16
Behavioral task
behavioral1
Sample
2D9F91AC0FE77150A2BC25302E4EA629.exe
Resource
win7v20210408
General
-
Target
2D9F91AC0FE77150A2BC25302E4EA629.exe
-
Size
45KB
-
MD5
2d9f91ac0fe77150a2bc25302e4ea629
-
SHA1
7fb56eb3ee9be33b13b80df969cdf0aaba59a573
-
SHA256
df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
-
SHA512
8582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
Malware Config
Extracted
asyncrat
0.5.7B
77.204.204.154:6606
AsyncMutex_6SI8OkPnk
-
aes_key
3JEv3splanEIrip0D2y4wDa4Uxi85seG
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
77.204.204.154
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606
-
version
0.5.7B
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svsystem.exepid process 3216 svsystem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4196 timeout.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exepid process 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exesvsystem.exedescription pid process Token: SeDebugPrivilege 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe Token: SeDebugPrivilege 3216 svsystem.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.execmd.execmd.exedescription pid process target process PID 4648 wrote to memory of 3244 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 4648 wrote to memory of 3244 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 4648 wrote to memory of 3244 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 4648 wrote to memory of 3316 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 4648 wrote to memory of 3316 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 4648 wrote to memory of 3316 4648 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 3244 wrote to memory of 4036 3244 cmd.exe schtasks.exe PID 3244 wrote to memory of 4036 3244 cmd.exe schtasks.exe PID 3244 wrote to memory of 4036 3244 cmd.exe schtasks.exe PID 3316 wrote to memory of 4196 3316 cmd.exe timeout.exe PID 3316 wrote to memory of 4196 3316 cmd.exe timeout.exe PID 3316 wrote to memory of 4196 3316 cmd.exe timeout.exe PID 3316 wrote to memory of 3216 3316 cmd.exe svsystem.exe PID 3316 wrote to memory of 3216 3316 cmd.exe svsystem.exe PID 3316 wrote to memory of 3216 3316 cmd.exe svsystem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8572.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svsystem.exe"C:\Users\Admin\AppData\Roaming\svsystem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8572.tmp.batMD5
318438ce3912b6db27f405ae8926d91d
SHA1191a3233f7753b0eeaf7a6be8952b3cf6ec3626e
SHA25663e214fc06ca8feb800fa9b31686314f3a056f402f898ce589a56b24c033cbc9
SHA5128bac3bdab701f20d4021772984005866df2b4961002030c8a56c9a4c0028f4c0bca93da1da0633347f77c8c9e616f4fe5c7d88d8685a5678cf13b561edf37c8a
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
memory/3216-123-0x0000000000000000-mapping.dmp
-
memory/3216-131-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/3216-130-0x0000000005BE0000-0x0000000005BE1000-memory.dmpFilesize
4KB
-
memory/3216-128-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/3244-118-0x0000000000000000-mapping.dmp
-
memory/3316-119-0x0000000000000000-mapping.dmp
-
memory/4036-121-0x0000000000000000-mapping.dmp
-
memory/4196-122-0x0000000000000000-mapping.dmp
-
memory/4648-114-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4648-117-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/4648-116-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB