Analysis
-
max time kernel
146s -
max time network
196s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 17:00
Static task
static1
Behavioral task
behavioral1
Sample
f97285590fe7f6afbfc514ddd2bc538e.exe
Resource
win7-en-20210920
General
-
Target
f97285590fe7f6afbfc514ddd2bc538e.exe
-
Size
255KB
-
MD5
f97285590fe7f6afbfc514ddd2bc538e
-
SHA1
1268214c0978b144583a2ceaae238c2042b8ddc7
-
SHA256
678d4084f84159e43cfb7acbeff823117b1a3610150bebefc202dcfe408b97c6
-
SHA512
7f602b0f19bc90eb2ba66572cd4d6149ac3020a7acf36bada7667d16e782bf895475abd0498d4c30975830d8b68f51e2ad3fdf1a7a64c2e040eb497aa3f3d023
Malware Config
Extracted
asyncrat
0.5.7B
Default
joselamartineslora09.duckdns.org:1980
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1612-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1612-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1612-67-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1612-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1612-79-0x0000000000510000-0x0000000000530000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 1612 InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exepid process 1112 f97285590fe7f6afbfc514ddd2bc538e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exedescription pid process target process PID 1112 set thread context of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exepowershell.exepid process 1112 f97285590fe7f6afbfc514ddd2bc538e.exe 768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1112 f97285590fe7f6afbfc514ddd2bc538e.exe Token: SeDebugPrivilege 768 powershell.exe Token: SeDebugPrivilege 1612 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exeWScript.exedescription pid process target process PID 1112 wrote to memory of 1624 1112 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 1112 wrote to memory of 1624 1112 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 1112 wrote to memory of 1624 1112 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 1112 wrote to memory of 1624 1112 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1112 wrote to memory of 1612 1112 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 1624 wrote to memory of 768 1624 WScript.exe powershell.exe PID 1624 wrote to memory of 768 1624 WScript.exe powershell.exe PID 1624 wrote to memory of 768 1624 WScript.exe powershell.exe PID 1624 wrote to memory of 768 1624 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97285590fe7f6afbfc514ddd2bc538e.exe"C:\Users\Admin\AppData\Local\Temp\f97285590fe7f6afbfc514ddd2bc538e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Tikbwdnflqabculmypdmfm.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads\iobituninstaller.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\_Tikbwdnflqabculmypdmfm.vbsMD5
5688b2eb801a351378401ff15237c20f
SHA15cbf0e609ac127d8d4bcdff972cdc61a310b702a
SHA256fcd85a624694b7643dfa007fcff9d14c0fa18b311a9add2cabf6d8f81541b3ce
SHA512d5a72caed29e8c362770d131a139d2c143d5b898f25b04d56b76f1ebec206faaebbd2343407e6d7204665f7e1986b7a3861b31d7859208b6979094e387775dba
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/768-76-0x0000000002512000-0x0000000002514000-memory.dmpFilesize
8KB
-
memory/768-75-0x0000000002511000-0x0000000002512000-memory.dmpFilesize
4KB
-
memory/768-74-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/768-69-0x0000000000000000-mapping.dmp
-
memory/1112-60-0x0000000000C00000-0x0000000000C12000-memory.dmpFilesize
72KB
-
memory/1112-53-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/1112-56-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1112-55-0x0000000000630000-0x0000000000667000-memory.dmpFilesize
220KB
-
memory/1612-78-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/1612-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-67-0x000000000040C75E-mapping.dmp
-
memory/1612-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1612-79-0x0000000000510000-0x0000000000530000-memory.dmpFilesize
128KB
-
memory/1624-59-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1624-57-0x0000000000000000-mapping.dmp