Analysis
- max time kernel
149s - max time network
166s - platform
windows7_x64 - resource
win7-20220331-en - submitted
04/04/2022, 03:21
General
- Target Cyup.exe
- Size 377KB
- Sample220404-dwb8jshec2
- SHA256 756517220093a59e69e6db3de1846896d146600389f742503804f25ba6fa74dd
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
2
-
212.193.30.54:9524
-
wyQ92!.,=FT72few
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cyup.exe"C:\Users\Admin\AppData\Local\Temp\Cyup.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/280-64-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-59-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-63-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-67-0x0000000000400000-0x0000000000412000-memory.dmp
memory/280-69-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1740-55-0x0000000075E71000-0x0000000075E73000-memory.dmp
memory/1740-56-0x0000000000650000-0x00000000006A4000-memory.dmp
memory/1740-57-0x0000000001E80000-0x0000000001EB0000-memory.dmp
memory/1740-58-0x0000000004270000-0x00000000042BC000-memory.dmp
memory/1740-54-0x0000000000180000-0x00000000001E4000-memory.dmp