Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
29-11-2021 11:45
Static task
static1
Behavioral task
behavioral1
Sample
Sega1b.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Sega1b.exe
Resource
win10-en-20211104
General
-
Target
Sega1b.exe
-
Size
509KB
-
MD5
98706453f50546ee727ee5617505a485
-
SHA1
67fa7f0cfd503800028ea2a5b8f5e9898368febd
-
SHA256
7e4f903b3491e6fd757e2963906acb0136ed28bb55158e37c6225a0fbada4122
-
SHA512
3c065cc4c642209fd61c78d0c4bbbeed23a8db466b255e9fa7761901a4dcfef72496a40513ea12817eccfe221ad4c23ae39d0b7798ada6e5862b0bcae1b3fc72
Malware Config
Extracted
asyncrat
0.5.7B
3
217.64.149.93:1973
df4Rtg34dFt5ynrew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1792-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1792-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1792-68-0x000000000040C6BE-mapping.dmp asyncrat behavioral1/memory/1792-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1792-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 1792 RegAsm.exe -
Loads dropped DLL 2 IoCs
Processes:
Sega1b.exeRegAsm.exepid process 1140 Sega1b.exe 1792 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Sega1b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\htj = "\"C:\\Users\\Admin\\AppData\\Roaming\\htj.exe\"" Sega1b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sega1b.exedescription pid process target process PID 1140 set thread context of 1792 1140 Sega1b.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Sega1b.exepid process 1140 Sega1b.exe 1140 Sega1b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Sega1b.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1140 Sega1b.exe Token: SeDebugPrivilege 1792 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Sega1b.exedescription pid process target process PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe PID 1140 wrote to memory of 1792 1140 Sega1b.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sega1b.exe"C:\Users\Admin\AppData\Local\Temp\Sega1b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
memory/1140-57-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/1140-58-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/1140-59-0x00000000003C0000-0x00000000003C2000-memory.dmpFilesize
8KB
-
memory/1140-60-0x00000000007D0000-0x000000000083B000-memory.dmpFilesize
428KB
-
memory/1140-61-0x0000000000790000-0x00000000007A4000-memory.dmpFilesize
80KB
-
memory/1140-55-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1792-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-68-0x000000000040C6BE-mapping.dmp
-
memory/1792-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1792-75-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB