Analysis
- max time kernel
122s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 19:38
General
- Target 5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe
- Size 486KB
- Sample220124-ycdmgshdh8
- SHA256 5e4bbf19a6e055cc6c2c98ef38288f3465c30e25542b735fbfca921fdb8b95f9
Malware Config
Extracted
-
asyncrat
-
v0.2
-
dhciaicjzis.xyz:1703
-
aisviua77s.xyz:1703
-
sakivivjasiv8cozo3.cn:1703
-
asidivuvuas8rnvns73.xyz:1703
-
dsijfiudsfiashvu7ds43.xyz:1703
-
afgj6j3umd5uk
-
anti_vm
false
-
bsod
false
-
delay
0
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 3 IoCs
- Modifies Windows Firewall 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe"C:\Users\Admin\AppData\Local\Temp\5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\filehistory.exec:\windows\system32\filehistory.exe2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\netsh.exe"netsh.exe" firewall add allowedprogram c:\windows\system32\filehistory.exe SystemUpdate ENABLE3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2476-115-0x0000015DD0070000-0x0000015DD00EE000-memory.dmp
memory/2772-116-0x0000000140000000-0x0000000140062000-memory.dmp
memory/2772-117-0x000001F7E6EA0000-0x000001F7E6EC2000-memory.dmp
memory/2772-118-0x000001F7E9160000-0x000001F7E9162000-memory.dmp
memory/2772-119-0x000001F7E9090000-0x000001F7E9106000-memory.dmp
memory/2772-120-0x000001F7E6E70000-0x000001F7E6E85000-memory.dmp
memory/2772-121-0x000001F7E8800000-0x000001F7E8821000-memory.dmp
memory/2772-122-0x000001F7E8830000-0x000001F7E885A000-memory.dmp
memory/2772-123-0x000001F7E8AD0000-0x000001F7E8B1A000-memory.dmp
memory/2772-124-0x000001F7E8860000-0x000001F7E8870000-memory.dmp
memory/2772-125-0x000001F7E9110000-0x000001F7E912E000-memory.dmp
memory/2772-126-0x000001F7EA350000-0x000001F7EA3BA000-memory.dmp
memory/2772-127-0x000001F7E8870000-0x000001F7E887A000-memory.dmp
memory/2772-128-0x000001F7EA3C0000-0x000001F7EA420000-memory.dmp
memory/2772-129-0x000001F7EA420000-0x000001F7EA4B0000-memory.dmp
memory/2772-130-0x000001F7EA5C0000-0x000001F7EB0DE000-memory.dmp
memory/2772-131-0x000001F7E88B0000-0x000001F7E88BA000-memory.dmp