Analysis
-
max time kernel
154s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
04-04-2022 03:21
Static task
static1
Behavioral task
behavioral1
Sample
Dmup.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
Dmup.exe
Resource
win10v2004-en-20220113
General
-
Target
Dmup.exe
-
Size
345KB
-
MD5
3812edfc14784ce52c995881e974353d
-
SHA1
c5846ad5d998be2d9de895b4fdccb17a3afcd5b2
-
SHA256
ce465307961879325090f1e36cb599bd60fecd44386240d89fbb82c7fdd40799
-
SHA512
3a832d0a255b883336e873afb4c5ff85e6526ac23a84ec4d6ba810ce6b7083f454d0513c68c9e076d0c40935021d62f7e423ad64410ffdf07a7f873a0a86d2db
Malware Config
Extracted
asyncrat
0.5.7B
2
212.193.30.54:9524
wyQ92!.,=FT72few
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/956-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/956-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/956-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/956-67-0x000000000040C6BE-mapping.dmp asyncrat behavioral1/memory/956-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/956-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dmup.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yhjysc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zgljnmrhu\\Yhjysc.exe\"" Dmup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dmup.exedescription pid process target process PID 1528 set thread context of 956 1528 Dmup.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 564 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Dmup.exepid process 1528 Dmup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Dmup.exedescription pid process Token: SeDebugPrivilege 1528 Dmup.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Dmup.execmd.exedescription pid process target process PID 1528 wrote to memory of 756 1528 Dmup.exe cmd.exe PID 1528 wrote to memory of 756 1528 Dmup.exe cmd.exe PID 1528 wrote to memory of 756 1528 Dmup.exe cmd.exe PID 1528 wrote to memory of 756 1528 Dmup.exe cmd.exe PID 756 wrote to memory of 564 756 cmd.exe timeout.exe PID 756 wrote to memory of 564 756 cmd.exe timeout.exe PID 756 wrote to memory of 564 756 cmd.exe timeout.exe PID 756 wrote to memory of 564 756 cmd.exe timeout.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe PID 1528 wrote to memory of 956 1528 Dmup.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dmup.exe"C:\Users\Admin\AppData\Local\Temp\Dmup.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 192⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 193⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-57-0x0000000000000000-mapping.dmp
-
memory/756-56-0x0000000000000000-mapping.dmp
-
memory/956-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-67-0x000000000040C6BE-mapping.dmp
-
memory/956-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/956-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1528-55-0x00000000769C1000-0x00000000769C3000-memory.dmpFilesize
8KB
-
memory/1528-58-0x0000000001FB0000-0x0000000001FFA000-memory.dmpFilesize
296KB
-
memory/1528-59-0x00000000041C0000-0x00000000041F0000-memory.dmpFilesize
192KB
-
memory/1528-60-0x0000000004A20000-0x0000000004A6C000-memory.dmpFilesize
304KB
-
memory/1528-54-0x0000000000310000-0x000000000036C000-memory.dmpFilesize
368KB