Analysis
- max time kernel
51s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/08/2021, 13:28
General
- Target Invoice Receipt.exe
- Size 183KB
- Sample210817-ndt4bssff6
- SHA256 486b4fcc5a6e4f4e949aa11aa3f2e9d8d2075ac8445617af8c41ab214f6dbfa0
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/572-116-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/572-117-0x0000000004A00000-0x0000000004A9C000-memory.dmp
memory/572-118-0x00000000024F0000-0x0000000002504000-memory.dmp
memory/572-114-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2780-126-0x0000000006390000-0x0000000006391000-memory.dmp
memory/2780-124-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/2780-119-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2780-127-0x0000000005E90000-0x0000000005E91000-memory.dmp
memory/2780-128-0x0000000006ED0000-0x0000000006ED1000-memory.dmp
memory/2780-129-0x0000000006020000-0x0000000006027000-memory.dmp
memory/2780-130-0x0000000006E90000-0x0000000006E91000-memory.dmp
memory/2780-131-0x00000000071F0000-0x00000000071F3000-memory.dmp
memory/2780-132-0x00000000072A0000-0x00000000072A1000-memory.dmp
memory/2780-133-0x0000000007230000-0x0000000007231000-memory.dmp
memory/2780-134-0x0000000007500000-0x0000000007643000-memory.dmp