Analysis
-
max time kernel
149s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:19
Behavioral task
behavioral1
Sample
PO_45_13.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO_45_13.scr
Resource
win10v2004-20220414-en
General
-
Target
PO_45_13.scr
-
Size
479KB
-
MD5
50c3085963b5fdc5a9c00d10d1b4f960
-
SHA1
6529e11136560ad369d1b443a6e60f4e1f85c71e
-
SHA256
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
-
SHA512
36318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837
Malware Config
Extracted
asyncrat
0.5.7B
Default
206.123.129.103:5456
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
windows.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1480-54-0x00000000008D0000-0x000000000094E000-memory.dmp asyncrat \Users\Admin\Music\Googles.exe asyncrat C:\Users\Admin\Music\Googles.exe asyncrat C:\Users\Admin\Music\Googles.exe asyncrat behavioral1/memory/880-65-0x0000000001300000-0x000000000137E000-memory.dmp asyncrat behavioral1/memory/704-76-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat behavioral1/memory/704-78-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat behavioral1/memory/704-79-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat behavioral1/memory/704-80-0x000000000040C72E-mapping.dmp asyncrat behavioral1/memory/704-83-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat behavioral1/memory/704-85-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Googles.exeInstallUtil.exepid process 880 Googles.exe 704 InstallUtil.exe -
Loads dropped DLL 4 IoCs
Processes:
PO_45_13.scrGoogles.exepid process 1480 PO_45_13.scr 1480 PO_45_13.scr 880 Googles.exe 880 Googles.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1480-56-0x0000000000380000-0x00000000003A2000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Googles = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Music\\Googles.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Googles.exedescription pid process target process PID 880 set thread context of 704 880 Googles.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO_45_13.scrGoogles.exepid process 1480 PO_45_13.scr 1480 PO_45_13.scr 880 Googles.exe 880 Googles.exe 880 Googles.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_45_13.scrGoogles.exedescription pid process Token: SeDebugPrivilege 1480 PO_45_13.scr Token: SeDebugPrivilege 880 Googles.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PO_45_13.scrcmd.exeGoogles.exedescription pid process target process PID 1480 wrote to memory of 2028 1480 PO_45_13.scr cmd.exe PID 1480 wrote to memory of 2028 1480 PO_45_13.scr cmd.exe PID 1480 wrote to memory of 2028 1480 PO_45_13.scr cmd.exe PID 1480 wrote to memory of 2028 1480 PO_45_13.scr cmd.exe PID 2028 wrote to memory of 1844 2028 cmd.exe reg.exe PID 2028 wrote to memory of 1844 2028 cmd.exe reg.exe PID 2028 wrote to memory of 1844 2028 cmd.exe reg.exe PID 2028 wrote to memory of 1844 2028 cmd.exe reg.exe PID 1480 wrote to memory of 880 1480 PO_45_13.scr Googles.exe PID 1480 wrote to memory of 880 1480 PO_45_13.scr Googles.exe PID 1480 wrote to memory of 880 1480 PO_45_13.scr Googles.exe PID 1480 wrote to memory of 880 1480 PO_45_13.scr Googles.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe PID 880 wrote to memory of 704 880 Googles.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_45_13.scr"C:\Users\Admin\AppData\Local\Temp\PO_45_13.scr" /S1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Googles /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Googles.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Googles /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Googles.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\Music\Googles.exe"C:\Users\Admin\Music\Googles.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\Music\Googles.exeFilesize
479KB
MD550c3085963b5fdc5a9c00d10d1b4f960
SHA16529e11136560ad369d1b443a6e60f4e1f85c71e
SHA2562c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
SHA51236318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837
-
C:\Users\Admin\Music\Googles.exeFilesize
479KB
MD550c3085963b5fdc5a9c00d10d1b4f960
SHA16529e11136560ad369d1b443a6e60f4e1f85c71e
SHA2562c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
SHA51236318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837
-
\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\Music\Googles.exeFilesize
479KB
MD550c3085963b5fdc5a9c00d10d1b4f960
SHA16529e11136560ad369d1b443a6e60f4e1f85c71e
SHA2562c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
SHA51236318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837
-
memory/704-73-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-74-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-85-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-83-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-80-0x000000000040C72E-mapping.dmp
-
memory/704-79-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-78-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/704-76-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/880-69-0x0000000074690000-0x0000000074710000-memory.dmpFilesize
512KB
-
memory/880-70-0x0000000000410000-0x000000000041A000-memory.dmpFilesize
40KB
-
memory/880-62-0x0000000000000000-mapping.dmp
-
memory/880-65-0x0000000001300000-0x000000000137E000-memory.dmpFilesize
504KB
-
memory/1480-54-0x00000000008D0000-0x000000000094E000-memory.dmpFilesize
504KB
-
memory/1480-56-0x0000000000380000-0x00000000003A2000-memory.dmpFilesize
136KB
-
memory/1480-58-0x0000000074690000-0x0000000074710000-memory.dmpFilesize
512KB
-
memory/1480-55-0x0000000074F91000-0x0000000074F93000-memory.dmpFilesize
8KB
-
memory/1844-60-0x0000000000000000-mapping.dmp
-
memory/2028-59-0x0000000000000000-mapping.dmp