Analysis
- max time kernel
4265061s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/01/2022, 11:20
General
- Target Wigburg.exe
- Size 222KB
- Sample220117-nffadaaafm
- SHA256 6d8f40e52347409c5bc0ecbd9c317caaba2ed624febb20d26381e478090ded33
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
ssonn.v6.rocks:7707
-
sson.dnsup.net:7707
-
PLPL
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
- Async RAT payload 3 IoCs
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wigburg.exe"C:\Users\Admin\AppData\Local\Temp\Wigburg.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/216-130-0x0000000000770000-0x00000000007AE000-memory.dmp
memory/216-131-0x0000000000770000-0x00000000007AE000-memory.dmp
memory/216-132-0x0000000005710000-0x0000000005CB4000-memory.dmp
memory/216-133-0x0000000005200000-0x0000000005292000-memory.dmp
memory/216-134-0x0000000005110000-0x0000000005111000-memory.dmp
memory/216-135-0x0000000005170000-0x000000000517A000-memory.dmp
memory/216-136-0x0000000005113000-0x0000000005115000-memory.dmp
memory/2668-138-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2668-139-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2668-140-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2668-141-0x0000000005190000-0x0000000005191000-memory.dmp
memory/2668-142-0x0000000005580000-0x000000000561C000-memory.dmp
memory/2668-143-0x0000000005BD0000-0x0000000006174000-memory.dmp
memory/2668-144-0x0000000005620000-0x0000000005686000-memory.dmp