Analysis
-
max time kernel
117s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
16-11-2021 14:41
General
-
Target
be96aa77ab7f76401001197bdb7d3e50.exe
-
Size
950KB
-
MD5
be96aa77ab7f76401001197bdb7d3e50
-
SHA1
1ef001ed0dfb0b2ca4b14775db3a9176cc4f9937
-
SHA256
49d69c50a7bfb5f2ae1b5c61af6c0ef870f08143a5548cb187e92461126c4147
-
SHA512
7ad1a3b65b13c2c708a568c7c2de91fc6960d80f7e7b77e26b4429a9c17e31baecdf0fe6d23a325cd7b2c4a613dbef3d7348409f8aba23ff6eeb7ddecc8a91eb
Malware Config
Extracted
asyncrat
1.0.7
Default
202.55.133.118:5200
DcRatMutex_qwqdanchun
-
anti_vm
false
-
bsod
false
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be96aa77ab7f76401001197bdb7d3e50.exe"C:\Users\Admin\AppData\Local\Temp\be96aa77ab7f76401001197bdb7d3e50.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/1896-57-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/1896-58-0x0000000004170000-0x0000000004191000-memory.dmpFilesize
132KB
-
memory/1896-59-0x0000000004871000-0x0000000004872000-memory.dmpFilesize
4KB
-
memory/1896-60-0x0000000004120000-0x000000000412B000-memory.dmpFilesize
44KB
-
memory/1896-61-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/1896-55-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2024-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-68-0x000000000040CB8E-mapping.dmp
-
memory/2024-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-73-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/2024-74-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB