Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    14-01-2022 09:16

General

  • Target

    f0b1460964ead846d1cf3c41026e8cba.exe

  • Size

    330KB

  • MD5

    f0b1460964ead846d1cf3c41026e8cba

  • SHA1

    75cded270a8cc13c3fbd170a71b441884a11ba23

  • SHA256

    4cbf005d08aae507c2d7aca647d2f95738d8610d7fdfbe8944010408695b7c1f

  • SHA512

    0564ffe06f37b3cfe335bda89b0685f7da8552630bb8ff0dce1a59682e4ae89312ebca8b51eab0b7660f54c5697580c0d59a593b63d5a0312b4a2ef74af58d24

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

212.193.30.54:8754

Mutex

gyQ12!.,=FDpsdf2_@

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0b1460964ead846d1cf3c41026e8cba.exe
    "C:\Users\Admin\AppData\Local\Temp\f0b1460964ead846d1cf3c41026e8cba.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/852-63-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-66-0x000000000040C6BE-mapping.dmp
  • memory/852-61-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-62-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-73-0x0000000004E90000-0x0000000004E91000-memory.dmp
    Filesize

    4KB

  • memory/852-64-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-65-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-72-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/852-71-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

  • memory/1676-58-0x0000000075021000-0x0000000075023000-memory.dmp
    Filesize

    8KB

  • memory/1676-56-0x0000000001200000-0x0000000001258000-memory.dmp
    Filesize

    352KB

  • memory/1676-57-0x0000000000410000-0x0000000000411000-memory.dmp
    Filesize

    4KB

  • memory/1676-59-0x0000000000600000-0x0000000000646000-memory.dmp
    Filesize

    280KB

  • memory/1676-55-0x0000000001200000-0x0000000001258000-memory.dmp
    Filesize

    352KB