Analysis
- max time kernel
88s - max time network
150s - platform
windows10_x64 - resource
win10-en - submitted
16/09/2021, 14:26
General
- Target Documento de carta de porte de Dhl,pdf.exe
- Size 455KB
- Sample210916-rrysmsgdhm
- SHA256 ae032c424848abf38b7ce6bbcb10d9abdec605cf01d1e0a067b2a1dce91df944
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
fmunity247.ddns.net:1234
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
- Async RAT payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-117-0x0000000000400000-0x0000000000412000-memory.dmp
memory/804-119-0x0000000005100000-0x0000000005101000-memory.dmp
memory/804-120-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/804-121-0x0000000005E40000-0x0000000005E41000-memory.dmp
memory/804-122-0x00000000059B0000-0x00000000059B1000-memory.dmp