Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:19
Behavioral task
behavioral1
Sample
NEW AUGUST PO no645678.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW AUGUST PO no645678.exe
Resource
win10v2004-20220414-en
General
-
Target
NEW AUGUST PO no645678.exe
-
Size
156KB
-
MD5
305f2747892b5f6d71320299e5c0c577
-
SHA1
187f9a3d1c59de18b76f17a533adbf2cc23e8cae
-
SHA256
423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
-
SHA512
1ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
Malware Config
Extracted
asyncrat
0.5.6A
5
79.134.225.85:1515
kurtbloomberg.ddns.net:1515
chsxzzvrmtz
-
delay
0
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-54-0x0000000000880000-0x00000000008AE000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe asyncrat C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe asyncrat C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe asyncrat behavioral1/memory/272-63-0x0000000000E20000-0x0000000000E4E000-memory.dmp asyncrat behavioral1/memory/1704-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1704-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1704-74-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1704-75-0x000000000040C3BE-mapping.dmp asyncrat behavioral1/memory/1704-78-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1704-80-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
abobex.exeInstallUtil.exepid process 272 abobex.exe 1704 InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
NEW AUGUST PO no645678.exeabobex.exepid process 1936 NEW AUGUST PO no645678.exe 272 abobex.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\abobex = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\abobex.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
abobex.exedescription pid process target process PID 272 set thread context of 1704 272 abobex.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
NEW AUGUST PO no645678.exeabobex.exeInstallUtil.exepid process 1936 NEW AUGUST PO no645678.exe 1936 NEW AUGUST PO no645678.exe 272 abobex.exe 272 abobex.exe 272 abobex.exe 1704 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NEW AUGUST PO no645678.exeabobex.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1936 NEW AUGUST PO no645678.exe Token: SeDebugPrivilege 272 abobex.exe Token: SeDebugPrivilege 1704 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEW AUGUST PO no645678.execmd.exeabobex.exedescription pid process target process PID 1936 wrote to memory of 1128 1936 NEW AUGUST PO no645678.exe cmd.exe PID 1936 wrote to memory of 1128 1936 NEW AUGUST PO no645678.exe cmd.exe PID 1936 wrote to memory of 1128 1936 NEW AUGUST PO no645678.exe cmd.exe PID 1936 wrote to memory of 1128 1936 NEW AUGUST PO no645678.exe cmd.exe PID 1128 wrote to memory of 956 1128 cmd.exe reg.exe PID 1128 wrote to memory of 956 1128 cmd.exe reg.exe PID 1128 wrote to memory of 956 1128 cmd.exe reg.exe PID 1128 wrote to memory of 956 1128 cmd.exe reg.exe PID 1936 wrote to memory of 272 1936 NEW AUGUST PO no645678.exe abobex.exe PID 1936 wrote to memory of 272 1936 NEW AUGUST PO no645678.exe abobex.exe PID 1936 wrote to memory of 272 1936 NEW AUGUST PO no645678.exe abobex.exe PID 1936 wrote to memory of 272 1936 NEW AUGUST PO no645678.exe abobex.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe PID 272 wrote to memory of 1704 272 abobex.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW AUGUST PO no645678.exe"C:\Users\Admin\AppData\Local\Temp\NEW AUGUST PO no645678.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v abobex /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v abobex /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exeFilesize
156KB
MD5305f2747892b5f6d71320299e5c0c577
SHA1187f9a3d1c59de18b76f17a533adbf2cc23e8cae
SHA256423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
SHA5121ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exeFilesize
156KB
MD5305f2747892b5f6d71320299e5c0c577
SHA1187f9a3d1c59de18b76f17a533adbf2cc23e8cae
SHA256423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
SHA5121ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exeFilesize
156KB
MD5305f2747892b5f6d71320299e5c0c577
SHA1187f9a3d1c59de18b76f17a533adbf2cc23e8cae
SHA256423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
SHA5121ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
-
memory/272-65-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/272-63-0x0000000000E20000-0x0000000000E4E000-memory.dmpFilesize
184KB
-
memory/272-60-0x0000000000000000-mapping.dmp
-
memory/272-66-0x0000000000520000-0x000000000052A000-memory.dmpFilesize
40KB
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/1128-57-0x0000000000000000-mapping.dmp
-
memory/1704-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-75-0x000000000040C3BE-mapping.dmp
-
memory/1704-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1704-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1936-56-0x0000000000240000-0x0000000000254000-memory.dmpFilesize
80KB
-
memory/1936-54-0x0000000000880000-0x00000000008AE000-memory.dmpFilesize
184KB
-
memory/1936-55-0x0000000074DD1000-0x0000000074DD3000-memory.dmpFilesize
8KB