Analysis
-
max time kernel
22s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-07-2021 15:04
Behavioral task
behavioral1
Sample
2D9F91AC0FE77150A2BC25302E4EA629.exe
Resource
win7v20210410
General
-
Target
2D9F91AC0FE77150A2BC25302E4EA629.exe
-
Size
45KB
-
MD5
2d9f91ac0fe77150a2bc25302e4ea629
-
SHA1
7fb56eb3ee9be33b13b80df969cdf0aaba59a573
-
SHA256
df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
-
SHA512
8582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
Malware Config
Extracted
asyncrat
0.5.7B
77.204.204.154:6606
AsyncMutex_6SI8OkPnk
-
aes_key
3JEv3splanEIrip0D2y4wDa4Uxi85seG
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
77.204.204.154
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606
-
version
0.5.7B
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat C:\Users\Admin\AppData\Roaming\svsystem.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svsystem.exepid process 3732 svsystem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3468 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exepid process 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe 568 2D9F91AC0FE77150A2BC25302E4EA629.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.exesvsystem.exedescription pid process Token: SeDebugPrivilege 568 2D9F91AC0FE77150A2BC25302E4EA629.exe Token: SeDebugPrivilege 3732 svsystem.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2D9F91AC0FE77150A2BC25302E4EA629.execmd.execmd.exedescription pid process target process PID 568 wrote to memory of 3736 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 568 wrote to memory of 3736 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 568 wrote to memory of 3736 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 568 wrote to memory of 184 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 568 wrote to memory of 184 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 568 wrote to memory of 184 568 2D9F91AC0FE77150A2BC25302E4EA629.exe cmd.exe PID 3736 wrote to memory of 1968 3736 cmd.exe schtasks.exe PID 3736 wrote to memory of 1968 3736 cmd.exe schtasks.exe PID 3736 wrote to memory of 1968 3736 cmd.exe schtasks.exe PID 184 wrote to memory of 3468 184 cmd.exe timeout.exe PID 184 wrote to memory of 3468 184 cmd.exe timeout.exe PID 184 wrote to memory of 3468 184 cmd.exe timeout.exe PID 184 wrote to memory of 3732 184 cmd.exe svsystem.exe PID 184 wrote to memory of 3732 184 cmd.exe svsystem.exe PID 184 wrote to memory of 3732 184 cmd.exe svsystem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"C:\Users\Admin\AppData\Local\Temp\2D9F91AC0FE77150A2BC25302E4EA629.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svsystem" /tr '"C:\Users\Admin\AppData\Roaming\svsystem.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp980F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svsystem.exe"C:\Users\Admin\AppData\Roaming\svsystem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp980F.tmp.batMD5
ee21dc8eb59026c9a1e325135587bd69
SHA1c7999f6a1d3608411f15993bf398727674b2d166
SHA2560f0600bd694fc258a2aa635ac376ad98c75d20b704604673a82fb2b1da718a8d
SHA512d0b420df52a4c4807b4cbdbff403641d4071da93bc5c369a0584535ceb5d5ebff119551e54ab589b5db075c9dd6b189c654c299b7c4db88ae599a6d4b3d4186e
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
C:\Users\Admin\AppData\Roaming\svsystem.exeMD5
2d9f91ac0fe77150a2bc25302e4ea629
SHA17fb56eb3ee9be33b13b80df969cdf0aaba59a573
SHA256df4d60e5d7a9c383b436485940669e2c5a392c1b4d1a067d4e75221329896b6c
SHA5128582989ded603f0a56d6cd7ceea410a4d4f2f17d7b81d3a9c914941fd112fc9b966fc718156699c47afb87726e14c050fd3c10c2efdc376772c7a3e5bc87ba37
-
memory/184-119-0x0000000000000000-mapping.dmp
-
memory/568-117-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/568-116-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/568-114-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1968-121-0x0000000000000000-mapping.dmp
-
memory/3468-122-0x0000000000000000-mapping.dmp
-
memory/3732-123-0x0000000000000000-mapping.dmp
-
memory/3732-128-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/3732-130-0x0000000006340000-0x0000000006341000-memory.dmpFilesize
4KB
-
memory/3732-131-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/3736-118-0x0000000000000000-mapping.dmp