Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-12-2021 16:54
Static task
static1
Behavioral task
behavioral1
Sample
57b64705c9b52be9842eb45e2721a0d5.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
57b64705c9b52be9842eb45e2721a0d5.exe
Resource
win10-en-20211014
General
-
Target
57b64705c9b52be9842eb45e2721a0d5.exe
-
Size
676KB
-
MD5
57b64705c9b52be9842eb45e2721a0d5
-
SHA1
0bea50c1a2205f7bbb8419fb970beb936866e9aa
-
SHA256
1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb
-
SHA512
28d8f1edb21458ea2e072033f24c409e2f767d14934278d80a50551e946826d50e6cafb6ac2a4e76510f1580692b1cdd3d6acf9d4b701d7c3954b79ec89a10a5
Malware Config
Extracted
asyncrat
0.5.7B
3
217.64.149.93:1973
df4Rtg34dFt5ynrew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/64-125-0x000000000040C6BE-mapping.dmp asyncrat behavioral2/memory/64-124-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 64 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
57b64705c9b52be9842eb45e2721a0d5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\ght = "\"C:\\Users\\Admin\\AppData\\Roaming\\ght.exe\"" 57b64705c9b52be9842eb45e2721a0d5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
57b64705c9b52be9842eb45e2721a0d5.exedescription pid process target process PID 1676 set thread context of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
57b64705c9b52be9842eb45e2721a0d5.exepid process 1676 57b64705c9b52be9842eb45e2721a0d5.exe 1676 57b64705c9b52be9842eb45e2721a0d5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
57b64705c9b52be9842eb45e2721a0d5.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1676 57b64705c9b52be9842eb45e2721a0d5.exe Token: SeDebugPrivilege 64 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
57b64705c9b52be9842eb45e2721a0d5.exedescription pid process target process PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe PID 1676 wrote to memory of 64 1676 57b64705c9b52be9842eb45e2721a0d5.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b64705c9b52be9842eb45e2721a0d5.exe"C:\Users\Admin\AppData\Local\Temp\57b64705c9b52be9842eb45e2721a0d5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
memory/64-125-0x000000000040C6BE-mapping.dmp
-
memory/64-131-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/64-130-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/64-124-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-119-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/1676-123-0x0000000000DE0000-0x0000000000DF4000-memory.dmpFilesize
80KB
-
memory/1676-122-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/1676-121-0x0000000007550000-0x00000000075BC000-memory.dmpFilesize
432KB
-
memory/1676-120-0x0000000002D80000-0x0000000002D81000-memory.dmpFilesize
4KB
-
memory/1676-115-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/1676-118-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/1676-117-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB