Analysis
-
max time kernel
120s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 12:38
Static task
static1
Behavioral task
behavioral1
Sample
BL. NO. ANSMUNDAR3621.exe
Resource
win7-en-20211014
General
-
Target
BL. NO. ANSMUNDAR3621.exe
-
Size
343KB
-
MD5
6e313f49084c58fcd006489103bac31a
-
SHA1
cfb76b45950b867da23054c1df26ce8e7a3f8274
-
SHA256
408e8ea1cbe31a44e822f1673cbfbe79dbd2938a1e449e61a661c1cceda8f322
-
SHA512
e75348da00f0e5d3089a38f8400b18cee22a057f6dc7da3068e49875d024e8512e90b9bdeaad3f866b4dfd0388b72952a4fbdb0a78c845cebaf4f253de1be2a2
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
185.222.57.71:00783
Attributes
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
aes.plain
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1372-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-66-0x000000000040C70E-mapping.dmp asyncrat behavioral1/memory/1372-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BL. NO. ANSMUNDAR3621.exedescription pid process target process PID 1636 set thread context of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
BL. NO. ANSMUNDAR3621.exepid process 1636 BL. NO. ANSMUNDAR3621.exe 1636 BL. NO. ANSMUNDAR3621.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BL. NO. ANSMUNDAR3621.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1636 BL. NO. ANSMUNDAR3621.exe Token: SeDebugPrivilege 1372 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
BL. NO. ANSMUNDAR3621.exedescription pid process target process PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL. NO. ANSMUNDAR3621.exe"C:\Users\Admin\AppData\Local\Temp\BL. NO. ANSMUNDAR3621.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
00:00
00:00
Downloads
-
memory/1372-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-66-0x000000000040C70E-mapping.dmp
-
memory/1372-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1372-70-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/1636-57-0x0000000076081000-0x0000000076083000-memory.dmpFilesize
8KB
-
memory/1636-58-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1636-59-0x0000000000430000-0x0000000000437000-memory.dmpFilesize
28KB
-
memory/1636-60-0x0000000000B00000-0x0000000000B2D000-memory.dmpFilesize
180KB
-
memory/1636-55-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
Loading data