Analysis
-
max time kernel
144s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 23:44
Static task
static1
Behavioral task
behavioral1
Sample
0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe
Resource
win7-20220414-en
General
-
Target
0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe
-
Size
615KB
-
MD5
707b8e65a6d7458fecc11f6ad9936854
-
SHA1
c32ba8c6988a3dab852f38ccc6423c1d0adfaa72
-
SHA256
0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6
-
SHA512
313403eb5ed4dd579d3a2fb74ce6a411b5fe120680756a8679775eb5aabc7179f0e7833917e37594000c71331590ee3bc16298cf58ed4104024f98ccaf5ada80
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:1194
127.0.0.1:61906
minerboy123-61906.portmap.host:1194
minerboy123-61906.portmap.host:61906
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Windows Explorer.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Tempwinlogon.exe asyncrat C:\Users\Admin\AppData\Local\Tempwinlogon.exe asyncrat C:\Users\Admin\AppData\Local\Tempwinlogon.exe asyncrat behavioral1/memory/1108-62-0x0000000000AA0000-0x0000000000ABE000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\Windows Explorer.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows Explorer.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows Explorer.exe asyncrat behavioral1/memory/1560-73-0x0000000001380000-0x000000000139E000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Tempwinlogon.exeWindows Explorer.exepid process 1108 Tempwinlogon.exe 1560 Windows Explorer.exe -
Loads dropped DLL 2 IoCs
Processes:
cscript.execmd.exepid process 1340 cscript.exe 1532 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 608 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Tempwinlogon.exepid process 1108 Tempwinlogon.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Tempwinlogon.exeWindows Explorer.exedescription pid process Token: SeDebugPrivilege 1108 Tempwinlogon.exe Token: SeDebugPrivilege 1560 Windows Explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.execscript.exeTempwinlogon.execmd.execmd.exedescription pid process target process PID 2028 wrote to memory of 1340 2028 0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe cscript.exe PID 2028 wrote to memory of 1340 2028 0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe cscript.exe PID 2028 wrote to memory of 1340 2028 0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe cscript.exe PID 2028 wrote to memory of 1340 2028 0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe cscript.exe PID 1340 wrote to memory of 1108 1340 cscript.exe Tempwinlogon.exe PID 1340 wrote to memory of 1108 1340 cscript.exe Tempwinlogon.exe PID 1340 wrote to memory of 1108 1340 cscript.exe Tempwinlogon.exe PID 1340 wrote to memory of 1108 1340 cscript.exe Tempwinlogon.exe PID 1108 wrote to memory of 1548 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1548 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1548 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1548 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1532 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1532 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1532 1108 Tempwinlogon.exe cmd.exe PID 1108 wrote to memory of 1532 1108 Tempwinlogon.exe cmd.exe PID 1548 wrote to memory of 696 1548 cmd.exe schtasks.exe PID 1548 wrote to memory of 696 1548 cmd.exe schtasks.exe PID 1548 wrote to memory of 696 1548 cmd.exe schtasks.exe PID 1548 wrote to memory of 696 1548 cmd.exe schtasks.exe PID 1532 wrote to memory of 608 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 608 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 608 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 608 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 1560 1532 cmd.exe Windows Explorer.exe PID 1532 wrote to memory of 1560 1532 cmd.exe Windows Explorer.exe PID 1532 wrote to memory of 1560 1532 cmd.exe Windows Explorer.exe PID 1532 wrote to memory of 1560 1532 cmd.exe Windows Explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe"C:\Users\Admin\AppData\Local\Temp\0190d8f34a79387e40de95958d59899ad99dd8bf17810e53502499810aae8aa6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.exe"cscript" C:\Users\Admin\AppData\Local\Temp\6D5.tmp\CryptedAsync.vbs2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Tempwinlogon.exe"C:\Users\Admin\AppData\Local\Tempwinlogon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp314E.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6D5.tmp\CryptedAsync.vbsFilesize
577KB
MD5473198cc93fa0767a9875a4203808f2d
SHA1267435de27e285e312cf90f2f4cd9b46023c5a4f
SHA2564aa4f8345805470d5185327fc06b946f2f690dd983a79343cc3dd7488d6ab9ec
SHA512c3beef74ee7924bfece3418a2522abf87f8051d9022483454ce286789418b36d55fe6d64df29da865faf2ce8f161723d77b9d1a8a058af15a1c60aef36e04308
-
C:\Users\Admin\AppData\Local\Temp\tmp314E.tmp.batFilesize
160B
MD59060f8c61fbd611630de699da8a2d439
SHA15231a2833b612b1a444e3d993a9b08169a597907
SHA256f2370ab64f1e29d59b18d70cce5f01e48c89e26480d82ac488d51c2681356184
SHA5124a4114e16415eeae6e8f615bb1a55664aa947526c970aa550797178be2fb2dd622ecfc8edbe8e1bcf6b86b04bad03c612d92f92fab1de258f3a0298bf8e578e1
-
C:\Users\Admin\AppData\Local\Tempwinlogon.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
C:\Users\Admin\AppData\Local\Tempwinlogon.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
C:\Users\Admin\AppData\Roaming\Windows Explorer.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
C:\Users\Admin\AppData\Roaming\Windows Explorer.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
\Users\Admin\AppData\Local\Tempwinlogon.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
\Users\Admin\AppData\Roaming\Windows Explorer.exeFilesize
96KB
MD53437d71b31312c0c0bc33b06fa42741b
SHA138d4338f4aa3eb3a190725d9281f5b972160161a
SHA25662205ec6c648a46c4ad0d1b7a63965f6bd94acda50149478dc05a1f5af6ff215
SHA512b20402563a66c969d4e2251260f9cffa3c8c3a4de1a9c1a16386b681b3b3e78fb8aa294203bb430dc08859ac366a7376d9855128d216179f66fa20eab8ecbf62
-
memory/608-68-0x0000000000000000-mapping.dmp
-
memory/696-66-0x0000000000000000-mapping.dmp
-
memory/1108-59-0x0000000000000000-mapping.dmp
-
memory/1108-62-0x0000000000AA0000-0x0000000000ABE000-memory.dmpFilesize
120KB
-
memory/1340-55-0x0000000000000000-mapping.dmp
-
memory/1532-65-0x0000000000000000-mapping.dmp
-
memory/1548-64-0x0000000000000000-mapping.dmp
-
memory/1560-71-0x0000000000000000-mapping.dmp
-
memory/1560-73-0x0000000001380000-0x000000000139E000-memory.dmpFilesize
120KB
-
memory/2028-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB