Analysis
- max time kernel
4294182s - max time network
148s - platform
windows7_x64 - resource
win7-20220310-en - submitted
08/04/2022, 00:12
General
- Target a6a36115e072d7ef31b40277e4695e2c.exe
- Size 407KB
- Sample220408-ag68lababm
- SHA256 162c17601f3f2d8eda02546e6ee08cabed5f01267fb75224073a3ac21f0ca3dc
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
107.182.237.14:58453
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
- suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
- Async RAT payload 6 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe"C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-54-0x0000000000A00000-0x0000000000A6C000-memory.dmp
memory/964-55-0x0000000000430000-0x000000000043A000-memory.dmp
memory/964-56-0x0000000005A30000-0x0000000005A94000-memory.dmp
memory/964-57-0x00000000009A0000-0x00000000009B2000-memory.dmp
memory/1436-58-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-59-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-61-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-63-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-66-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-68-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1436-69-0x00000000758A1000-0x00000000758A3000-memory.dmp