Analysis
- max time kernel
117s - max time network
140s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
17/01/2022, 11:20
General
- Target Wigburg.exe
- Size 222KB
- Sample220117-nffadaaafm
- SHA256 6d8f40e52347409c5bc0ecbd9c317caaba2ed624febb20d26381e478090ded33
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
ssonn.v6.rocks:7707
-
sson.dnsup.net:7707
-
PLPL
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
- Async RAT payload 6 IoCs
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wigburg.exe"C:\Users\Admin\AppData\Local\Temp\Wigburg.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/968-67-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-69-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/968-68-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-63-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-64-0x0000000000400000-0x0000000000412000-memory.dmp
memory/968-61-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1728-56-0x0000000075B11000-0x0000000075B13000-memory.dmp
memory/1728-59-0x0000000001EF0000-0x0000000001F1C000-memory.dmp
memory/1728-54-0x00000000002F0000-0x000000000032E000-memory.dmp
memory/1728-58-0x0000000004C75000-0x0000000004C86000-memory.dmp
memory/1728-57-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/1728-55-0x00000000002F0000-0x000000000032E000-memory.dmp