Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 17:00
Static task
static1
Behavioral task
behavioral1
Sample
f97285590fe7f6afbfc514ddd2bc538e.exe
Resource
win7-en-20210920
General
-
Target
f97285590fe7f6afbfc514ddd2bc538e.exe
-
Size
255KB
-
MD5
f97285590fe7f6afbfc514ddd2bc538e
-
SHA1
1268214c0978b144583a2ceaae238c2042b8ddc7
-
SHA256
678d4084f84159e43cfb7acbeff823117b1a3610150bebefc202dcfe408b97c6
-
SHA512
7f602b0f19bc90eb2ba66572cd4d6149ac3020a7acf36bada7667d16e782bf895475abd0498d4c30975830d8b68f51e2ad3fdf1a7a64c2e040eb497aa3f3d023
Malware Config
Extracted
asyncrat
0.5.7B
Default
joselamartineslora09.duckdns.org:1980
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/680-123-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/680-124-0x000000000040C75E-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
InstallUtil.exeInstallUtil.exepid process 2156 InstallUtil.exe 680 InstallUtil.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exeInstallUtil.exedescription pid process target process PID 3496 set thread context of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 680 set thread context of 2456 680 InstallUtil.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings f97285590fe7f6afbfc514ddd2bc538e.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exepowershell.exepid process 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3496 f97285590fe7f6afbfc514ddd2bc538e.exe 3440 powershell.exe 3440 powershell.exe 3440 powershell.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exepowershell.exeInstallUtil.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3496 f97285590fe7f6afbfc514ddd2bc538e.exe Token: SeDebugPrivilege 3440 powershell.exe Token: SeDebugPrivilege 680 InstallUtil.exe Token: SeDebugPrivilege 2456 MSBuild.exe Token: 33 2456 MSBuild.exe Token: SeIncBasePriorityPrivilege 2456 MSBuild.exe Token: 33 2456 MSBuild.exe Token: SeIncBasePriorityPrivilege 2456 MSBuild.exe Token: 33 2456 MSBuild.exe Token: SeIncBasePriorityPrivilege 2456 MSBuild.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
f97285590fe7f6afbfc514ddd2bc538e.exeWScript.exeInstallUtil.exedescription pid process target process PID 3496 wrote to memory of 2856 3496 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 3496 wrote to memory of 2856 3496 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 3496 wrote to memory of 2856 3496 f97285590fe7f6afbfc514ddd2bc538e.exe WScript.exe PID 3496 wrote to memory of 2156 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 2156 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 2156 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 3496 wrote to memory of 680 3496 f97285590fe7f6afbfc514ddd2bc538e.exe InstallUtil.exe PID 2856 wrote to memory of 3440 2856 WScript.exe powershell.exe PID 2856 wrote to memory of 3440 2856 WScript.exe powershell.exe PID 2856 wrote to memory of 3440 2856 WScript.exe powershell.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe PID 680 wrote to memory of 2456 680 InstallUtil.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97285590fe7f6afbfc514ddd2bc538e.exe"C:\Users\Admin\AppData\Local\Temp\f97285590fe7f6afbfc514ddd2bc538e.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Tikbwdnflqabculmypdmfm.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads\iobituninstaller.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeC:\Users\Admin\AppData\Local\Temp\InstallUtil.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\_Tikbwdnflqabculmypdmfm.vbsMD5
5688b2eb801a351378401ff15237c20f
SHA15cbf0e609ac127d8d4bcdff972cdc61a310b702a
SHA256fcd85a624694b7643dfa007fcff9d14c0fa18b311a9add2cabf6d8f81541b3ce
SHA512d5a72caed29e8c362770d131a139d2c143d5b898f25b04d56b76f1ebec206faaebbd2343407e6d7204665f7e1986b7a3861b31d7859208b6979094e387775dba
-
memory/680-142-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/680-123-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/680-124-0x000000000040C75E-mapping.dmp
-
memory/2456-393-0x000000000040678E-mapping.dmp
-
memory/2456-399-0x0000000005160000-0x000000000565E000-memory.dmpFilesize
5.0MB
-
memory/2856-119-0x0000000000000000-mapping.dmp
-
memory/3440-137-0x0000000007CA0000-0x0000000007CA1000-memory.dmpFilesize
4KB
-
memory/3440-141-0x0000000008400000-0x0000000008401000-memory.dmpFilesize
4KB
-
memory/3440-130-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/3440-131-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/3440-132-0x0000000006EB0000-0x0000000006EB1000-memory.dmpFilesize
4KB
-
memory/3440-133-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/3440-135-0x0000000006F42000-0x0000000006F43000-memory.dmpFilesize
4KB
-
memory/3440-134-0x0000000006F40000-0x0000000006F41000-memory.dmpFilesize
4KB
-
memory/3440-136-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/3440-166-0x0000000009940000-0x0000000009941000-memory.dmpFilesize
4KB
-
memory/3440-138-0x0000000007DC0000-0x0000000007DC1000-memory.dmpFilesize
4KB
-
memory/3440-139-0x0000000007F30000-0x0000000007F31000-memory.dmpFilesize
4KB
-
memory/3440-140-0x00000000083C0000-0x00000000083C1000-memory.dmpFilesize
4KB
-
memory/3440-127-0x0000000000000000-mapping.dmp
-
memory/3440-164-0x000000007EBC0000-0x000000007EBC1000-memory.dmpFilesize
4KB
-
memory/3440-143-0x00000000086D0000-0x00000000086D1000-memory.dmpFilesize
4KB
-
memory/3440-144-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/3440-151-0x0000000009420000-0x0000000009453000-memory.dmpFilesize
204KB
-
memory/3440-158-0x0000000009400000-0x0000000009401000-memory.dmpFilesize
4KB
-
memory/3440-163-0x0000000009560000-0x0000000009561000-memory.dmpFilesize
4KB
-
memory/3440-165-0x0000000006F43000-0x0000000006F44000-memory.dmpFilesize
4KB
-
memory/3496-115-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/3496-120-0x0000000005520000-0x0000000005532000-memory.dmpFilesize
72KB
-
memory/3496-117-0x0000000005200000-0x0000000005237000-memory.dmpFilesize
220KB
-
memory/3496-118-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB