Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 12:35
Static task
static1
Behavioral task
behavioral1
Sample
PO_Contract_ANR07152112_20210715181907__110.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
PO_Contract_ANR07152112_20210715181907__110.exe
-
Size
259KB
-
MD5
59a60d464d1a53db32c8f9d1851e861b
-
SHA1
33ed4fa55a5a6e2ac4689360dcce5420de49c1b2
-
SHA256
d845c164a62d42c00550da72c49c92296d6e73e6aca723915c0a0ebbd5b494cc
-
SHA512
e85b976cc95b45587907168abcc6829eba479a9679f56b5ac5edabcb1947d4f8666ef8c00bde2fddf7080cd8caf2cdad43cfe964211c7b5a92fb4d7fe4ceb19b
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
185.222.57.71:00783
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
anti_vm
false
-
bsod
false
-
delay
20
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
aes.plain
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/820-124-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/820-125-0x000000000040C70E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exedescription pid process target process PID 2764 set thread context of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exepid process 2764 PO_Contract_ANR07152112_20210715181907__110.exe 2764 PO_Contract_ANR07152112_20210715181907__110.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2764 PO_Contract_ANR07152112_20210715181907__110.exe Token: SeDebugPrivilege 820 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PO_Contract_ANR07152112_20210715181907__110.exedescription pid process target process PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe PID 2764 wrote to memory of 820 2764 PO_Contract_ANR07152112_20210715181907__110.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_Contract_ANR07152112_20210715181907__110.exe"C:\Users\Admin\AppData\Local\Temp\PO_Contract_ANR07152112_20210715181907__110.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-124-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/820-125-0x000000000040C70E-mapping.dmp
-
memory/820-128-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/820-131-0x0000000006190000-0x0000000006191000-memory.dmpFilesize
4KB
-
memory/2764-115-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/2764-117-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/2764-118-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2764-119-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/2764-120-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/2764-121-0x0000000007FE0000-0x0000000007FE6000-memory.dmpFilesize
24KB
-
memory/2764-122-0x0000000008310000-0x0000000008311000-memory.dmpFilesize
4KB
-
memory/2764-123-0x00000000082B0000-0x00000000082DD000-memory.dmpFilesize
180KB