Analysis
-
max time kernel
15s -
max time network
190s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-07-2021 15:04
Behavioral task
behavioral1
Sample
2D9F91AC0FE77150A2BC25302E4EA629.exe
Resource
win7v20210410
General
-
Target
2D9F91AC0FE77150A2BC25302E4EA629.exe
-
Size
45KB
-
MD5
2d9f91ac0fe77150a2bc25302e4ea629
-
SHA1
7fb56eb3ee9be33b13b80df969cdf0aaba59a573
-
SHA256
df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
-
SHA512
8582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
Malware Config
Extracted
asyncrat
0.5.7B
77.204.204.154:6606
AsyncMutex_6SI8OkPnk
-
aes_key
3JEv3splanEIrip0D2y4wDa4Uxi85seG
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
77.204.204.154
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606
-
version
0.5.7B
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat \Users\Admin\AppData\Roaming\svsystem.exe asyncrat C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svsystem.exepid process 888 svsystem.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1648 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 520 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exepid process 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exesvsystem.exedescription pid process Token: SeDebugPrivilege 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe Token: SeDebugPrivilege 888 svsystem.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.execmd.execmd.exedescription pid process target process PID 1140 wrote to memory of 1680 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1680 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1680 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1680 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1648 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1648 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1648 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1140 wrote to memory of 1648 1140 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 1680 wrote to memory of 668 1680 cmd.exe schtasks.exe PID 1680 wrote to memory of 668 1680 cmd.exe schtasks.exe PID 1680 wrote to memory of 668 1680 cmd.exe schtasks.exe PID 1680 wrote to memory of 668 1680 cmd.exe schtasks.exe PID 1648 wrote to memory of 520 1648 cmd.exe timeout.exe PID 1648 wrote to memory of 520 1648 cmd.exe timeout.exe PID 1648 wrote to memory of 520 1648 cmd.exe timeout.exe PID 1648 wrote to memory of 520 1648 cmd.exe timeout.exe PID 1648 wrote to memory of 888 1648 cmd.exe svsystem.exe PID 1648 wrote to memory of 888 1648 cmd.exe svsystem.exe PID 1648 wrote to memory of 888 1648 cmd.exe svsystem.exe PID 1648 wrote to memory of 888 1648 cmd.exe svsystem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpCB5A.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svsystem.exe"C:\Users\Admin\AppData\Roaming\svsystem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCB5A.tmp.batMD5
886af9e4fe5986973c0405f535a1792b
SHA1d6dbbc496b77e4b75d5818f489c6b031c2f5b13f
SHA25626e91236daa2974f674fc2b5bd0da0d203b34ff8eeec09b12b88906b0ec97467
SHA51276c46e1b23bffa33a31ac50fc0ac14d6419c3d20b6d84c7527ad50926c0702c2dce63c42ea46080f2488b44266616f2033508af299af93eebfd68e62c701eed1
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
memory/520-67-0x0000000000000000-mapping.dmp
-
memory/668-66-0x0000000000000000-mapping.dmp
-
memory/888-70-0x0000000000000000-mapping.dmp
-
memory/888-72-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/888-75-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/1140-59-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1140-62-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1140-61-0x0000000075D41000-0x0000000075D43000-memory.dmpFilesize
8KB
-
memory/1648-64-0x0000000000000000-mapping.dmp
-
memory/1680-63-0x0000000000000000-mapping.dmp