Analysis
-
max time kernel
122s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
29-10-2021 12:35
Static task
static1
Behavioral task
behavioral1
Sample
PO_Contract_ANR07152112_20210715181907__110.exe
Resource
win7-en-20211014
General
-
Target
PO_Contract_ANR07152112_20210715181907__110.exe
-
Size
259KB
-
MD5
59a60d464d1a53db32c8f9d1851e861b
-
SHA1
33ed4fa55a5a6e2ac4689360dcce5420de49c1b2
-
SHA256
d845c164a62d42c00550da72c49c92296d6e73e6aca723915c0a0ebbd5b494cc
-
SHA512
e85b976cc95b45587907168abcc6829eba479a9679f56b5ac5edabcb1947d4f8666ef8c00bde2fddf7080cd8caf2cdad43cfe964211c7b5a92fb4d7fe4ceb19b
Malware Config
Extracted
asyncrat
0.5.7B
Default
185.222.57.71:00783
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
20
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/612-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/612-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/612-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/612-65-0x000000000040C70E-mapping.dmp asyncrat behavioral1/memory/612-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exedescription pid process target process PID 1960 set thread context of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exepid process 1960 PO_Contract_ANR07152112_20210715181907__110.exe 1960 PO_Contract_ANR07152112_20210715181907__110.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1960 PO_Contract_ANR07152112_20210715181907__110.exe Token: SeDebugPrivilege 612 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exedescription pid process target process PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 1960 wrote to memory of 612 1960 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_Contract_ANR07152112_20210715181907__110.exe"C:\Users\Admin\AppData\Local\Temp\PO_Contract_ANR07152112_20210715181907__110.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-65-0x000000000040C70E-mapping.dmp
-
memory/612-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/612-68-0x0000000075901000-0x0000000075903000-memory.dmpFilesize
8KB
-
memory/612-69-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/1960-57-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1960-58-0x00000000009B0000-0x00000000009B6000-memory.dmpFilesize
24KB
-
memory/1960-59-0x00000000011D0000-0x00000000011FD000-memory.dmpFilesize
180KB
-
memory/1960-55-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB