Analysis
-
max time kernel
156s -
max time network
171s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 21:26
Static task
static1
Behavioral task
behavioral1
Sample
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe
-
Size
617KB
-
MD5
8febef9e39284335678e45955722d6a6
-
SHA1
0f5de2557c7cef0c486157089cf2b761ca8839d7
-
SHA256
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf
-
SHA512
e8b70e73b960b4fa3fa209baaf702990dc4a153cca85eca5a9586ab42dab82d99d6ecec15c9ed043cca2637710f2921f94b2a2b934c9960fe36514cdf4ceacbf
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
1
C2
185.157.160.136:1973
Mutex
df4Rtg34dFjwr7ujp3
Attributes
-
anti_vm
false
-
bsod
false
-
delay
38
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
aes.plain
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-120-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1228-121-0x000000000040C6BE-mapping.dmp asyncrat behavioral1/memory/1228-129-0x0000000005B90000-0x0000000005BAB000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\rka = "C:\\Users\\Admin\\AppData\\Roaming\\rga\\rpa.exe" 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exedescription pid process target process PID 3516 set thread context of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid process 1228 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1228 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exepid process 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exeRegSvcs.execmd.exedescription pid process target process PID 3516 wrote to memory of 1136 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1136 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1136 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 3516 wrote to memory of 1228 3516 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe RegSvcs.exe PID 1228 wrote to memory of 3188 1228 RegSvcs.exe cmd.exe PID 1228 wrote to memory of 3188 1228 RegSvcs.exe cmd.exe PID 1228 wrote to memory of 3188 1228 RegSvcs.exe cmd.exe PID 3188 wrote to memory of 1040 3188 cmd.exe powershell.exe PID 3188 wrote to memory of 1040 3188 cmd.exe powershell.exe PID 3188 wrote to memory of 1040 3188 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe"C:\Users\Admin\AppData\Local\Temp\7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qczzgn.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qczzgn.exe"'4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-132-0x0000000000000000-mapping.dmp
-
memory/1228-125-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1228-120-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1228-121-0x000000000040C6BE-mapping.dmp
-
memory/1228-124-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/1228-126-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/1228-127-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/1228-128-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/1228-129-0x0000000005B90000-0x0000000005BAB000-memory.dmpFilesize
108KB
-
memory/1228-130-0x00000000077E0000-0x00000000077E1000-memory.dmpFilesize
4KB
-
memory/3188-131-0x0000000000000000-mapping.dmp
-
memory/3516-118-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/3516-119-0x00000000001D0000-0x00000000001DA000-memory.dmpFilesize
40KB