asyncrat | 7cc41705eced60b2388896ebed5a2fe3afe250705f71a293ed5131b219a44691

General

Target

Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Size

207KB
MD5

d8cbee400f429451d895c0fa516fbec2
SHA1

e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256

964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA512

6e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2760-124-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

DriiveUpdate.exeDriiveUpdate.exe

pid process

3952 DriiveUpdate.exe
3924 DriiveUpdate.exe

pid	process
3952	DriiveUpdate.exe
3924	DriiveUpdate.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exe

description	pid	process	target process
PID 3420 set thread context of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3952 set thread context of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1260 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2920 timeout.exe

pid	process
1260	schtasks.exe

pid	process
2920	timeout.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exe

pid	process
3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
3952	DriiveUpdate.exe
3952	DriiveUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exeDriiveUpdate.exe

description	pid	process
Token: SeDebugPrivilege	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Token: SeDebugPrivilege	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Token: SeDebugPrivilege	3952	DriiveUpdate.exe
Token: SeDebugPrivilege	3924	DriiveUpdate.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.execmd.execmd.exeDriiveUpdate.exe

description	pid	process	target process
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 3420 wrote to memory of 2760	3420	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
PID 2760 wrote to memory of 3228	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 2760 wrote to memory of 3228	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 2760 wrote to memory of 3228	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 2760 wrote to memory of 3216	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 2760 wrote to memory of 3216	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 2760 wrote to memory of 3216	2760	Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe	cmd.exe
PID 3228 wrote to memory of 1260	3228	cmd.exe	schtasks.exe
PID 3228 wrote to memory of 1260	3228	cmd.exe	schtasks.exe
PID 3228 wrote to memory of 1260	3228	cmd.exe	schtasks.exe
PID 3216 wrote to memory of 2920	3216	cmd.exe	timeout.exe
PID 3216 wrote to memory of 2920	3216	cmd.exe	timeout.exe
PID 3216 wrote to memory of 2920	3216	cmd.exe	timeout.exe
PID 3216 wrote to memory of 3952	3216	cmd.exe	DriiveUpdate.exe
PID 3216 wrote to memory of 3952	3216	cmd.exe	DriiveUpdate.exe
PID 3216 wrote to memory of 3952	3216	cmd.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe
PID 3952 wrote to memory of 3924	3952	DriiveUpdate.exe	DriiveUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
"C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420

C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
"C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "DriiveUpdate" /tr '"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "DriiveUpdate" /tr '"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"'
4⤵
- Creates scheduled task(s)
PID:1260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA9A9.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\SysWOW64\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2920

C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe
"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe
"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe.log
MD5
f1181bc4bdff57024c4121f645548332

SHA1
d431ee3a3a5afcae2c4537b1d445054a0a95f6e6

SHA256
f1a7e138b25d0cb24bb4b23bd781b0dd357afd49d45e19ffa44cdb80170336ad

SHA512
cf8059f289bcb4f33e82a2c4851fade486bd449793a39718d49bc357efd09689150aedd277c5ebcf79b5ebb4bbe36f0cbb72510a50398bee804ffd9c889604e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DriiveUpdate.exe.log
MD5
f1181bc4bdff57024c4121f645548332

SHA1
d431ee3a3a5afcae2c4537b1d445054a0a95f6e6

SHA256
f1a7e138b25d0cb24bb4b23bd781b0dd357afd49d45e19ffa44cdb80170336ad

SHA512
cf8059f289bcb4f33e82a2c4851fade486bd449793a39718d49bc357efd09689150aedd277c5ebcf79b5ebb4bbe36f0cbb72510a50398bee804ffd9c889604e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA9A9.tmp.bat
MD5
ef8cf017656c882158a4b5b06ec8443c

SHA1
5b493cb5440ec4db88201840e4f897d278addb7a

SHA256
a7400815ed605d74f35ee995ddde89833069e163dba300e997c6fb3af217a9a1

SHA512
7981c4ad8325d7010f80ba13c354a5ea81522fc21d947ca2711ebcce8d180828ae615df47998ff2da66bc42b8079566756a05ac25f33ac56ce6b49bd09f2c3c2

Download Submit
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe
MD5
d8cbee400f429451d895c0fa516fbec2

SHA1
e55216848d4b41e0f34b8411d63353e7dee8a999

SHA256
964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56

SHA512
6e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975

Download Submit
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe
MD5
d8cbee400f429451d895c0fa516fbec2

SHA1
e55216848d4b41e0f34b8411d63353e7dee8a999

SHA256
964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56

SHA512
6e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975

Download Submit
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe
MD5
d8cbee400f429451d895c0fa516fbec2

SHA1
e55216848d4b41e0f34b8411d63353e7dee8a999

SHA256
964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56

SHA512
6e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975

Download Submit
memory/2760-124-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2760-125-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/3420-119-0x0000000004C80000-0x0000000004C8A000-memory.dmp

Filesize
40KB

Download
memory/3420-123-0x00000000073D0000-0x0000000007408000-memory.dmp

Filesize
224KB

Download
memory/3420-122-0x0000000007430000-0x00000000074CC000-memory.dmp

Filesize
624KB

Download
memory/3420-121-0x00000000070B0000-0x00000000070FB000-memory.dmp

Filesize
300KB

Download
memory/3420-120-0x00000000070A0000-0x00000000070AC000-memory.dmp

Filesize
48KB

Download
memory/3420-115-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3420-118-0x0000000004BC0000-0x0000000004C52000-memory.dmp

Filesize
584KB

Download
memory/3420-117-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/3420-116-0x00000000051A0000-0x000000000569E000-memory.dmp

Filesize
5.0MB

Download
memory/3924-134-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3952-130-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads