General
Target

3c39836dedf6779a0207819c72238fa5.exe

Filesize

671KB

Completed

22-02-2022 09:01

Task

behavioral1

Score
10/10
MD5

3c39836dedf6779a0207819c72238fa5

SHA1

07433edf63057fff1e96ddbf5249aa2c50f69dbd

SHA256

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87

SHA256

f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

212.193.30.54:8755

Attributes
anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null
aes.plain
Signatures 8

Filter: none

Collection
Credential Access
Defense Evasion
Persistence
  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/332-61-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/332-62-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/332-63-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/332-64-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    3c39836dedf6779a0207819c72238fa5.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dslfiip = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cltjej\\Dslfiip.exe\""3c39836dedf6779a0207819c72238fa5.exe
  • Suspicious use of SetThreadContext
    3c39836dedf6779a0207819c72238fa5.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 984 set thread context of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
  • Suspicious behavior: EnumeratesProcesses
    3c39836dedf6779a0207819c72238fa5.exe

    Reported IOCs

    pidprocess
    9843c39836dedf6779a0207819c72238fa5.exe
  • Suspicious use of AdjustPrivilegeToken
    3c39836dedf6779a0207819c72238fa5.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege9843c39836dedf6779a0207819c72238fa5.exe
  • Suspicious use of WriteProcessMemory
    3c39836dedf6779a0207819c72238fa5.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
    PID 984 wrote to memory of 3329843c39836dedf6779a0207819c72238fa5.exeMSBuild.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\3c39836dedf6779a0207819c72238fa5.exe
    "C:\Users\Admin\AppData\Local\Temp\3c39836dedf6779a0207819c72238fa5.exe"
    Adds Run key to start application
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      PID:332
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • memory/332-62-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-66-0x0000000076451000-0x0000000076453000-memory.dmp

                  • memory/332-65-0x00000000745BE000-0x00000000745BF000-memory.dmp

                  • memory/332-64-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-63-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-59-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-60-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-61-0x0000000000400000-0x0000000000412000-memory.dmp

                  • memory/332-67-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                  • memory/984-58-0x0000000000790000-0x00000000007DC000-memory.dmp

                  • memory/984-57-0x0000000001180000-0x0000000001181000-memory.dmp

                  • memory/984-56-0x00000000010D0000-0x000000000116E000-memory.dmp

                  • memory/984-55-0x00000000745BE000-0x00000000745BF000-memory.dmp

                  • memory/984-54-0x0000000001240000-0x00000000012EE000-memory.dmp