Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 17:50
Static task
static1
Behavioral task
behavioral1
Sample
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
Resource
win7-20220414-en
General
-
Target
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
-
Size
652KB
-
MD5
68aebe67b9ab7f84a4d0520a41de005c
-
SHA1
aeef03bc26334beb3a92ca7f991772cdf8dd79f4
-
SHA256
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9
-
SHA512
ce173574ceedf7bb672cdbaa69f81e05b659a62d1131f930740d25c56e58db1efdbe70817db84096596274d067153ebcbaedf12bf817a7531ddd8d2f6ccc7546
Malware Config
Extracted
asyncrat
0.5.7B
Default
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-66-0x000000000040C76E-mapping.dmp asyncrat behavioral1/memory/1716-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription pid process target process PID 480 set thread context of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription pid process target process PID 480 wrote to memory of 2028 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 480 wrote to memory of 2028 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 480 wrote to memory of 2028 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 480 wrote to memory of 2028 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 480 wrote to memory of 1716 480 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IAapkDPBpUFkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFE6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBFE6.tmpFilesize
1KB
MD571f369d4284e4a4bacba183159cf0f58
SHA1e6102b8bc9221927743f2dbefe487c1893f37362
SHA2564eb8d10cde85d0009c7d4ee607ef00496b930dc652bd9087be3d5dd800b109ce
SHA512587a65dd217e8f67a41d5896d8867a5a142d10fa7bd0d33506bb0a906a9ea18352d91549ff82ce2f287bdc461e6b3ac63f729bdc86438233924059edc186dee0
-
memory/480-55-0x0000000075941000-0x0000000075943000-memory.dmpFilesize
8KB
-
memory/480-56-0x0000000000240000-0x0000000000254000-memory.dmpFilesize
80KB
-
memory/480-57-0x0000000000570000-0x00000000005B6000-memory.dmpFilesize
280KB
-
memory/480-54-0x0000000000870000-0x000000000091A000-memory.dmpFilesize
680KB
-
memory/1716-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-66-0x000000000040C76E-mapping.dmp
-
memory/1716-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2028-58-0x0000000000000000-mapping.dmp