Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-02-2022 08:58
Static task
static1
Behavioral task
behavioral1
Sample
3c39836dedf6779a0207819c72238fa5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3c39836dedf6779a0207819c72238fa5.exe
Resource
win10v2004-en-20220113
General
-
Target
3c39836dedf6779a0207819c72238fa5.exe
-
Size
671KB
-
MD5
3c39836dedf6779a0207819c72238fa5
-
SHA1
07433edf63057fff1e96ddbf5249aa2c50f69dbd
-
SHA256
34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
-
SHA512
f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/332-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/332-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/332-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/332-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3c39836dedf6779a0207819c72238fa5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dslfiip = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cltjej\\Dslfiip.exe\"" 3c39836dedf6779a0207819c72238fa5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c39836dedf6779a0207819c72238fa5.exedescription pid process target process PID 984 set thread context of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3c39836dedf6779a0207819c72238fa5.exepid process 984 3c39836dedf6779a0207819c72238fa5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3c39836dedf6779a0207819c72238fa5.exedescription pid process Token: SeDebugPrivilege 984 3c39836dedf6779a0207819c72238fa5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3c39836dedf6779a0207819c72238fa5.exedescription pid process target process PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe PID 984 wrote to memory of 332 984 3c39836dedf6779a0207819c72238fa5.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c39836dedf6779a0207819c72238fa5.exe"C:\Users\Admin\AppData\Local\Temp\3c39836dedf6779a0207819c72238fa5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/332-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/332-67-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/332-66-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/332-65-0x00000000745BE000-0x00000000745BF000-memory.dmpFilesize
4KB
-
memory/332-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/332-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/332-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/332-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/984-54-0x0000000001240000-0x00000000012EE000-memory.dmpFilesize
696KB
-
memory/984-55-0x00000000745BE000-0x00000000745BF000-memory.dmpFilesize
4KB
-
memory/984-58-0x0000000000790000-0x00000000007DC000-memory.dmpFilesize
304KB
-
memory/984-57-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/984-56-0x00000000010D0000-0x000000000116E000-memory.dmpFilesize
632KB