Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 17:50
Static task
static1
Behavioral task
behavioral1
Sample
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
Resource
win7-20220414-en
General
-
Target
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
-
Size
652KB
-
MD5
68aebe67b9ab7f84a4d0520a41de005c
-
SHA1
aeef03bc26334beb3a92ca7f991772cdf8dd79f4
-
SHA256
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9
-
SHA512
ce173574ceedf7bb672cdbaa69f81e05b659a62d1131f930740d25c56e58db1efdbe70817db84096596274d067153ebcbaedf12bf817a7531ddd8d2f6ccc7546
Malware Config
Extracted
asyncrat
0.5.7B
Default
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-139-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription pid process target process PID 4624 set thread context of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exepid process 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription pid process Token: SeDebugPrivilege 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exedescription pid process target process PID 4624 wrote to memory of 4380 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 4624 wrote to memory of 4380 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 4624 wrote to memory of 4380 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe schtasks.exe PID 4624 wrote to memory of 4760 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4760 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4760 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe PID 4624 wrote to memory of 4872 4624 e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IAapkDPBpUFkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21EF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmp21EF.tmpFilesize
1KB
MD5b9eb7932d815f7ade882d3f839b0c522
SHA1a04a66e7346677687a033b54c7b30e3d9646eff3
SHA256b3d77a0e1d7f8c467c899818d53668ea40a15d6764f91c4aa01fc252a297f7b2
SHA512bf32daaafdf9491cfc16e79c63ce90d63cafdf77a375db1c450c32ea8ada02c02cc1918af57b846ad36922416ae463e45f8c8377c8fb86ada600de28b8608025
-
memory/4380-135-0x0000000000000000-mapping.dmp
-
memory/4624-130-0x00000000000F0000-0x000000000019A000-memory.dmpFilesize
680KB
-
memory/4624-131-0x0000000005150000-0x00000000056F4000-memory.dmpFilesize
5.6MB
-
memory/4624-132-0x0000000004BA0000-0x0000000004C32000-memory.dmpFilesize
584KB
-
memory/4624-133-0x0000000004B40000-0x0000000004B4A000-memory.dmpFilesize
40KB
-
memory/4624-134-0x0000000008470000-0x000000000850C000-memory.dmpFilesize
624KB
-
memory/4760-137-0x0000000000000000-mapping.dmp
-
memory/4872-138-0x0000000000000000-mapping.dmp
-
memory/4872-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB