Overview

overview

10

Static

static

10

22021cdbf9...99.exe

windows7_x64

10

22021cdbf9...99.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 13:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22021cdbf9936f8a469ecb5e11636799.exe

  • Size

    63KB

  • MD5

    22021cdbf9936f8a469ecb5e11636799

  • SHA1

    9a3186aaa9fa202c1666d5b751db53b13b961002

  • SHA256

    d775bef532e71e692eb0e66292da60db38864a4f3dba5d2382ace1992ddd55f3

  • SHA512

    f3efc9a323bf144cdec2db10e33bdcae5512543cbddc349d21a9ecce9108bc376aa3777cc15f01c3954497091b7bac3c4b8afb9a1c18008c8dc92f4058a9e45b

Score
10/10
asyncratdefaultratsuricata

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

bigrussianfloppa.duckdns.org:1001

Mutex

Mutex_qwqdanchun

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    1

  • install

    true

  • install_file

    Churkaebanaya.exe

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)

    suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)

    suricata
  • Async RAT payload 3 IoCs
    rat
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22021cdbf9936f8a469ecb5e11636799.exe
    "C:\Users\Admin\AppData\Local\Temp\22021cdbf9936f8a469ecb5e11636799.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Churkaebanaya" /tr '"C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "Churkaebanaya" /tr '"C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:1136
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp411C.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:384
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1164
      • C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe
        "C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp411C.tmp.bat
    MD5

    9299516d8297d409eabcf280c6d82eca

    SHA1

    74c524c18fbcdb93187a758c16c8dd798a636117

    SHA256

    358ab48c2fa47519c46fba2dfe009a43be215b1f3f40638629035f69dd6ddb9b

    SHA512

    64438c3be72f52b68d62aa5d37c81ee5af5c862917f5e04291790a5c45fb579dda9524b4a11f0effc8122a79bf082451b1551bc40f3cfc45a17084070c06e83c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe
    MD5

    22021cdbf9936f8a469ecb5e11636799

    SHA1

    9a3186aaa9fa202c1666d5b751db53b13b961002

    SHA256

    d775bef532e71e692eb0e66292da60db38864a4f3dba5d2382ace1992ddd55f3

    SHA512

    f3efc9a323bf144cdec2db10e33bdcae5512543cbddc349d21a9ecce9108bc376aa3777cc15f01c3954497091b7bac3c4b8afb9a1c18008c8dc92f4058a9e45b

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Churkaebanaya.exe
    MD5

    22021cdbf9936f8a469ecb5e11636799

    SHA1

    9a3186aaa9fa202c1666d5b751db53b13b961002

    SHA256

    d775bef532e71e692eb0e66292da60db38864a4f3dba5d2382ace1992ddd55f3

    SHA512

    f3efc9a323bf144cdec2db10e33bdcae5512543cbddc349d21a9ecce9108bc376aa3777cc15f01c3954497091b7bac3c4b8afb9a1c18008c8dc92f4058a9e45b

    Download Submit
  • memory/2368-120-0x000000001BAC0000-0x000000001BAC2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3836-115-0x00000000009C0000-0x00000000009D6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/3836-116-0x0000000002BB0000-0x0000000002BB2000-memory.dmp
    Filesize

    8KB

    Download