asyncrat | 2568251040acb82859e2944aac69d01701c95d89d3d28e30a02b5445a0946ca1

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-12-2021 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52f13f6be6220affb4acc182f974dabe.exe
Size

841KB
MD5

52f13f6be6220affb4acc182f974dabe
SHA1

275d2e03ece179e04787fd2fd4174589a4794d2d
SHA256

2568251040acb82859e2944aac69d01701c95d89d3d28e30a02b5445a0946ca1
SHA512

13ee949087eaf6253b2f2395c2e00bf44e303cd334971219faf87e2bfd83371df51d543d20f834cf5dbaacfc81928e3c2590501de8a816bfbfb40866413af330

Score

10^/10

asyncrat matiex default collection evasion keylogger rat spyware stealer

Malware Config

Extracted

Family

matiex

https://api.telegram.org/bot1915791669:AAHbaTcWupO_GTP0Ize2y4KAhHdYK5bPczo/sendMessage?chat_id=1114717555

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

52.178.132.52:6606

52.178.132.52:7707

52.178.132.52:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
true
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\BIBILZ.exe	family_matiex
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe	family_matiex
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe	family_matiex
behavioral1/memory/1112-65-0x0000000001290000-0x0000000001306000-memory.dmp	family_matiex
behavioral1/memory/1112-66-0x0000000001290000-0x0000000001306000-memory.dmp	family_matiex

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2040-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2040-75-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2040-73-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2040-76-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/2040-77-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2040-78-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

BIBILZ.exe

pid process

1112 BIBILZ.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

pid	process
1112	BIBILZ.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

52f13f6be6220affb4acc182f974dabe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52f13f6be6220affb4acc182f974dabe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52f13f6be6220affb4acc182f974dabe.exe

Drops startup file 1 IoCs

Processes:

BIBILZ.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%nmoufstr%.url BIBILZ.exe
Loads dropped DLL 1 IoCs

Processes:

52f13f6be6220affb4acc182f974dabe.exe

pid process

1684 52f13f6be6220affb4acc182f974dabe.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%nmoufstr%.url	BIBILZ.exe

pid	process
1684	52f13f6be6220affb4acc182f974dabe.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

BIBILZ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BIBILZ.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BIBILZ.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BIBILZ.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 checkip.dyndns.org
12 freegeoip.app
13 freegeoip.app

flow	ioc
7	checkip.dyndns.org
12	freegeoip.app
13	freegeoip.app

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

52f13f6be6220affb4acc182f974dabe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	52f13f6be6220affb4acc182f974dabe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	52f13f6be6220affb4acc182f974dabe.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

52f13f6be6220affb4acc182f974dabe.exe

description pid process target process

PID 1684 set thread context of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1032 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

BIBILZ.exe

pid process

1112 BIBILZ.exe

description	pid	process	target process
PID 1684 set thread context of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe

pid	process
1032	schtasks.exe

pid	process
1112	BIBILZ.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

52f13f6be6220affb4acc182f974dabe.exeBIBILZ.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1684	52f13f6be6220affb4acc182f974dabe.exe
Token: SeDebugPrivilege	1112	BIBILZ.exe
Token: SeDebugPrivilege	2040	vbc.exe
Token: SeDebugPrivilege	2040	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

52f13f6be6220affb4acc182f974dabe.exeBIBILZ.exe

description	pid	process	target process
PID 1684 wrote to memory of 1112	1684	52f13f6be6220affb4acc182f974dabe.exe	BIBILZ.exe
PID 1684 wrote to memory of 1112	1684	52f13f6be6220affb4acc182f974dabe.exe	BIBILZ.exe
PID 1684 wrote to memory of 1112	1684	52f13f6be6220affb4acc182f974dabe.exe	BIBILZ.exe
PID 1684 wrote to memory of 1112	1684	52f13f6be6220affb4acc182f974dabe.exe	BIBILZ.exe
PID 1684 wrote to memory of 1032	1684	52f13f6be6220affb4acc182f974dabe.exe	schtasks.exe
PID 1684 wrote to memory of 1032	1684	52f13f6be6220affb4acc182f974dabe.exe	schtasks.exe
PID 1684 wrote to memory of 1032	1684	52f13f6be6220affb4acc182f974dabe.exe	schtasks.exe
PID 1684 wrote to memory of 1032	1684	52f13f6be6220affb4acc182f974dabe.exe	schtasks.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1684 wrote to memory of 2040	1684	52f13f6be6220affb4acc182f974dabe.exe	vbc.exe
PID 1112 wrote to memory of 1136	1112	BIBILZ.exe	netsh.exe
PID 1112 wrote to memory of 1136	1112	BIBILZ.exe	netsh.exe
PID 1112 wrote to memory of 1136	1112	BIBILZ.exe	netsh.exe
PID 1112 wrote to memory of 1136	1112	BIBILZ.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

BIBILZ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BIBILZ.exe

outlook_win_path 1 IoCs

Processes:

BIBILZ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BIBILZ.exe

C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe
"C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe
"C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1112

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1136

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cOSEdHWJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp"
2⤵
- Creates scheduled task(s)
PID:1032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe
MD5
3909dfbc501304e780b91e47bae11c6f

SHA1
9ecfeb5103ab0d066678e2d537ae6a8a996f7306

SHA256
6584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1

SHA512
591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe
MD5
3909dfbc501304e780b91e47bae11c6f

SHA1
9ecfeb5103ab0d066678e2d537ae6a8a996f7306

SHA256
6584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1

SHA512
591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp
MD5
7c52a86ea15666e9df488c8c73f7f67b

SHA1
0f870c3b373fd023352f4fe3dfc977895c8226db

SHA256
6676e9c4548f869c58dce7f7378eae4a71069ae40dee2f43f2de8c3aa497dfe7

SHA512
eaf3f7a07d134d89b0701594060055942636892a9ddc736e9ee6e5fb3e2367f8bc68cdc4fc2f7c23ce76de43b5e4546ecb76888405e181498ab1508f5a474429

Download Submit
\Users\Admin\AppData\Local\Temp\BIBILZ.exe
MD5
3909dfbc501304e780b91e47bae11c6f

SHA1
9ecfeb5103ab0d066678e2d537ae6a8a996f7306

SHA256
6584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1

SHA512
591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e

Download Submit
memory/1032-68-0x0000000000000000-mapping.dmp

Download
memory/1112-74-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/1112-66-0x0000000001290000-0x0000000001306000-memory.dmp

Filesize
472KB

Download
memory/1112-65-0x0000000001290000-0x0000000001306000-memory.dmp

Filesize
472KB

Download
memory/1112-62-0x0000000000000000-mapping.dmp

Download
memory/1136-81-0x0000000000000000-mapping.dmp

Download
memory/1684-59-0x0000000005B10000-0x0000000005B76000-memory.dmp

Filesize
408KB

Download
memory/1684-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1684-53-0x0000000001080000-0x0000000001158000-memory.dmp

Filesize
864KB

Download
memory/1684-58-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1684-57-0x00000000005B0000-0x00000000005C4000-memory.dmp

Filesize
80KB

Download
memory/1684-56-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/1684-54-0x0000000001080000-0x0000000001158000-memory.dmp

Filesize
864KB

Download
memory/1684-60-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/2040-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-73-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-76-0x000000000040C71E-mapping.dmp

Download
memory/2040-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-80-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/2040-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download