Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-02-2022 20:19
Static task
static1
Behavioral task
behavioral1
Sample
5cdfcd6d591946dec15cec637f7826e6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5cdfcd6d591946dec15cec637f7826e6.exe
Resource
win10v2004-en-20220113
General
-
Target
5cdfcd6d591946dec15cec637f7826e6.exe
-
Size
309KB
-
MD5
5cdfcd6d591946dec15cec637f7826e6
-
SHA1
7959aeda9d64e19b9eeed15003c49a0c62eadf45
-
SHA256
bc0c6f07b05e4c29bae36fedd9e58e1cd0148d777a68d50ec5104567d9e3ce43
-
SHA512
e8a3363aaaecc5902aa93b4754d24e03c86cabe4132f6aa0111c8b575fcfa5b0e1ff7127279f0808f83c01547e043efffe628207272d1d61aa8697c926ac194b
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8754
gyQ12!.,=FDpsdf2_@
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1216-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1216-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1216-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1216-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5cdfcd6d591946dec15cec637f7826e6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\gkn = "\"C:\\Users\\Admin\\AppData\\Roaming\\gkn.exe\"" 5cdfcd6d591946dec15cec637f7826e6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5cdfcd6d591946dec15cec637f7826e6.exedescription pid process target process PID 1592 set thread context of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1912 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exe5cdfcd6d591946dec15cec637f7826e6.exepid process 584 powershell.exe 1592 5cdfcd6d591946dec15cec637f7826e6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe5cdfcd6d591946dec15cec637f7826e6.exedescription pid process Token: SeDebugPrivilege 584 powershell.exe Token: SeDebugPrivilege 1592 5cdfcd6d591946dec15cec637f7826e6.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
5cdfcd6d591946dec15cec637f7826e6.exepowershell.execmd.exedescription pid process target process PID 1592 wrote to memory of 584 1592 5cdfcd6d591946dec15cec637f7826e6.exe powershell.exe PID 1592 wrote to memory of 584 1592 5cdfcd6d591946dec15cec637f7826e6.exe powershell.exe PID 1592 wrote to memory of 584 1592 5cdfcd6d591946dec15cec637f7826e6.exe powershell.exe PID 1592 wrote to memory of 584 1592 5cdfcd6d591946dec15cec637f7826e6.exe powershell.exe PID 584 wrote to memory of 628 584 powershell.exe cmd.exe PID 584 wrote to memory of 628 584 powershell.exe cmd.exe PID 584 wrote to memory of 628 584 powershell.exe cmd.exe PID 584 wrote to memory of 628 584 powershell.exe cmd.exe PID 628 wrote to memory of 1912 628 cmd.exe timeout.exe PID 628 wrote to memory of 1912 628 cmd.exe timeout.exe PID 628 wrote to memory of 1912 628 cmd.exe timeout.exe PID 628 wrote to memory of 1912 628 cmd.exe timeout.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe PID 1592 wrote to memory of 1216 1592 5cdfcd6d591946dec15cec637f7826e6.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cdfcd6d591946dec15cec637f7826e6.exe"C:\Users\Admin\AppData\Local\Temp\5cdfcd6d591946dec15cec637f7826e6.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAzAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 233⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 234⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-60-0x00000000023B1000-0x00000000023B2000-memory.dmpFilesize
4KB
-
memory/584-61-0x00000000023B2000-0x00000000023B4000-memory.dmpFilesize
8KB
-
memory/584-59-0x0000000071D82000-0x0000000071D84000-memory.dmpFilesize
8KB
-
memory/584-57-0x0000000071D81000-0x0000000071D82000-memory.dmpFilesize
4KB
-
memory/584-58-0x00000000023B0000-0x00000000023B1000-memory.dmpFilesize
4KB
-
memory/1216-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-74-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/1216-73-0x00000000739EE000-0x00000000739EF000-memory.dmpFilesize
4KB
-
memory/1216-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1592-63-0x0000000000810000-0x0000000000840000-memory.dmpFilesize
192KB
-
memory/1592-65-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/1592-53-0x0000000000F40000-0x0000000000F94000-memory.dmpFilesize
336KB
-
memory/1592-64-0x00000000048F0000-0x000000000493C000-memory.dmpFilesize
304KB
-
memory/1592-55-0x0000000074AFE000-0x0000000074AFF000-memory.dmpFilesize
4KB
-
memory/1592-62-0x0000000000EA0000-0x0000000000EE0000-memory.dmpFilesize
256KB
-
memory/1592-54-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB