Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 08:40
Static task
static1
Behavioral task
behavioral1
Sample
ea38cfcc0258377c4feedfc30ed0bbc1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ea38cfcc0258377c4feedfc30ed0bbc1.exe
Resource
win10v2004-20220414-en
General
-
Target
ea38cfcc0258377c4feedfc30ed0bbc1.exe
-
Size
180KB
-
MD5
ea38cfcc0258377c4feedfc30ed0bbc1
-
SHA1
7b3bbfdffbfdaf8209d30f33c545b54abfd2816f
-
SHA256
1b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
-
SHA512
3920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
Malware Config
Extracted
asyncrat
1.0.7
Default
62.197.136.195:3333
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
testversion.exe
-
install_folder
%Temp%
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
ea38cfcc0258377c4feedfc30ed0bbc1.exetestversion.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\9Db52or07ibYr5kr\\qruRhMqS1xrs.exe\",explorer.exe" ea38cfcc0258377c4feedfc30ed0bbc1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\9Db52or07ibYr5kr\\QxjL420iMmRR.exe\",explorer.exe" testversion.exe -
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
-
Async RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1092-58-0x00000000004B0000-0x00000000004C2000-memory.dmp asyncrat behavioral1/memory/1220-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1220-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1220-65-0x000000000040CBBE-mapping.dmp asyncrat behavioral1/memory/1220-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1220-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1220-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1728-83-0x00000000005A0000-0x00000000005B2000-memory.dmp asyncrat behavioral1/memory/1992-93-0x000000000040CBBE-mapping.dmp asyncrat -
Executes dropped EXE 3 IoCs
Processes:
testversion.exetestversion.exetestversion.exepid process 1728 testversion.exe 2028 testversion.exe 1992 testversion.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exetestversion.exepid process 2016 cmd.exe 1728 testversion.exe 1728 testversion.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ea38cfcc0258377c4feedfc30ed0bbc1.exetestversion.exedescription pid process target process PID 1092 set thread context of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1728 set thread context of 1992 1728 testversion.exe testversion.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 896 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ea38cfcc0258377c4feedfc30ed0bbc1.exeea38cfcc0258377c4feedfc30ed0bbc1.exetestversion.exepid process 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe 1728 testversion.exe 1728 testversion.exe 1728 testversion.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ea38cfcc0258377c4feedfc30ed0bbc1.exeea38cfcc0258377c4feedfc30ed0bbc1.exetestversion.exetestversion.exedescription pid process Token: SeDebugPrivilege 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe Token: SeDebugPrivilege 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe Token: SeDebugPrivilege 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe Token: SeDebugPrivilege 1728 testversion.exe Token: SeDebugPrivilege 1728 testversion.exe Token: SeDebugPrivilege 1992 testversion.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
ea38cfcc0258377c4feedfc30ed0bbc1.exeea38cfcc0258377c4feedfc30ed0bbc1.execmd.execmd.exetestversion.exedescription pid process target process PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1092 wrote to memory of 1220 1092 ea38cfcc0258377c4feedfc30ed0bbc1.exe ea38cfcc0258377c4feedfc30ed0bbc1.exe PID 1220 wrote to memory of 584 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 584 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 584 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 584 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 2016 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 2016 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 2016 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 1220 wrote to memory of 2016 1220 ea38cfcc0258377c4feedfc30ed0bbc1.exe cmd.exe PID 584 wrote to memory of 2032 584 cmd.exe schtasks.exe PID 584 wrote to memory of 2032 584 cmd.exe schtasks.exe PID 584 wrote to memory of 2032 584 cmd.exe schtasks.exe PID 584 wrote to memory of 2032 584 cmd.exe schtasks.exe PID 2016 wrote to memory of 896 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 896 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 896 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 896 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 1728 2016 cmd.exe testversion.exe PID 2016 wrote to memory of 1728 2016 cmd.exe testversion.exe PID 2016 wrote to memory of 1728 2016 cmd.exe testversion.exe PID 2016 wrote to memory of 1728 2016 cmd.exe testversion.exe PID 1728 wrote to memory of 2028 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 2028 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 2028 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 2028 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe PID 1728 wrote to memory of 1992 1728 testversion.exe testversion.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea38cfcc0258377c4feedfc30ed0bbc1.exe"C:\Users\Admin\AppData\Local\Temp\ea38cfcc0258377c4feedfc30ed0bbc1.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea38cfcc0258377c4feedfc30ed0bbc1.exe"C:\Users\Admin\AppData\Local\Temp\ea38cfcc0258377c4feedfc30ed0bbc1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "testversion" /tr '"C:\Users\Admin\AppData\Local\Temp\testversion.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "testversion" /tr '"C:\Users\Admin\AppData\Local\Temp\testversion.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2A9A.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\testversion.exe"C:\Users\Admin\AppData\Local\Temp\testversion.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\testversion.exe"C:\Users\Admin\AppData\Local\Temp\testversion.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\testversion.exe"C:\Users\Admin\AppData\Local\Temp\testversion.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
C:\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
C:\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
C:\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
C:\Users\Admin\AppData\Local\Temp\tmp2A9A.tmp.batFilesize
158B
MD5fae02d330c33d35d22e9e0eaf2402d7c
SHA19a0eb6a774ea1834de27485e78b6645337d2b387
SHA2564768e0ec833d5a75385d84a38743cd43b01b67776bb173b8e9c1fcf4de59485a
SHA5120c15fa9871ff3e3ef658249dc819e4b4be1896c3b3d444ca403cd6c30bce3949034b04ab8cf284a7f676d7e7f8b8b87f8729e2033bc4968b720b7bfaac19cafa
-
\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
\Users\Admin\AppData\Local\Temp\testversion.exeFilesize
180KB
MD5ea38cfcc0258377c4feedfc30ed0bbc1
SHA17b3bbfdffbfdaf8209d30f33c545b54abfd2816f
SHA2561b0a551577b66e5829eabfbdd99459b779d713a127812788ab96f90e08340e64
SHA5123920ac4956040655c0afac75d4030689ae367f324647c70e43a174938bed8a0ae993b417bb21d96a3ca31f631201b7fbfbbf6b89b37814815f51618d0e3928cc
-
memory/584-71-0x0000000000000000-mapping.dmp
-
memory/896-75-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000000B10000-0x0000000000B44000-memory.dmpFilesize
208KB
-
memory/1092-58-0x00000000004B0000-0x00000000004C2000-memory.dmpFilesize
72KB
-
memory/1092-57-0x00000000048A5000-0x00000000048B6000-memory.dmpFilesize
68KB
-
memory/1092-56-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/1092-55-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1220-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-65-0x000000000040CBBE-mapping.dmp
-
memory/1220-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1220-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1728-82-0x0000000004E35000-0x0000000004E46000-memory.dmpFilesize
68KB
-
memory/1728-83-0x00000000005A0000-0x00000000005B2000-memory.dmpFilesize
72KB
-
memory/1728-80-0x00000000012F0000-0x0000000001324000-memory.dmpFilesize
208KB
-
memory/1728-78-0x0000000000000000-mapping.dmp
-
memory/1992-93-0x000000000040CBBE-mapping.dmp
-
memory/2016-72-0x0000000000000000-mapping.dmp
-
memory/2032-74-0x0000000000000000-mapping.dmp