Analysis
-
max time kernel
139s -
max time network
154s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
01-07-2022 00:51
General
-
Target
ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe
-
Size
45KB
-
MD5
8535ef83ad230663fb31734e0b64ed07
-
SHA1
e5ddf52ba32126319dad2324ad54878af656a10e
-
SHA256
ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d
-
SHA512
e351bbc61f39ef1700894f95e22c9d56780566dd5564a9e6f2943844542c12bc93cae8d459f95d0b97dcfd0f2ab26fa5ba710f8621f276be962ea96df2d53ce8
Malware Config
Extracted
asyncrat
0.5.7B
Default
212.192.246.207:3162
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
explorer.exe
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3692-147-0x00000000000F0000-0x0000000000102000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorer.exe asyncrat C:\Users\Admin\AppData\Roaming\explorer.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 3612 explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2448 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exepid process 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe Token: SeDebugPrivilege 3612 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.execmd.execmd.exedescription pid process target process PID 3692 wrote to memory of 4044 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 3692 wrote to memory of 4044 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 3692 wrote to memory of 4044 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 3692 wrote to memory of 1744 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 3692 wrote to memory of 1744 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 3692 wrote to memory of 1744 3692 ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe cmd.exe PID 4044 wrote to memory of 1392 4044 cmd.exe schtasks.exe PID 4044 wrote to memory of 1392 4044 cmd.exe schtasks.exe PID 4044 wrote to memory of 1392 4044 cmd.exe schtasks.exe PID 1744 wrote to memory of 2448 1744 cmd.exe timeout.exe PID 1744 wrote to memory of 2448 1744 cmd.exe timeout.exe PID 1744 wrote to memory of 2448 1744 cmd.exe timeout.exe PID 1744 wrote to memory of 3612 1744 cmd.exe explorer.exe PID 1744 wrote to memory of 3612 1744 cmd.exe explorer.exe PID 1744 wrote to memory of 3612 1744 cmd.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe"C:\Users\Admin\AppData\Local\Temp\ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"C:\Users\Admin\AppData\Roaming\explorer.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"C:\Users\Admin\AppData\Roaming\explorer.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9223.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9223.tmp.batFilesize
152B
MD5cbbcce201269b2f62e8341500afe3bfa
SHA113e3fb8f0dfec28a7b93e15534244fa2103a74d1
SHA256ecf3a6f2f9f7ffc9256137987b00f490c267b96c895bbb88ab4fe26c5a5aab24
SHA5121707d565635621242bf8f867b60c1c8561085548420d457ba9201bff420a3a4ba74ec1552d7df432cdb6dd6a13ddaf1503ede3951716fa87346d94ba958290a6
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
45KB
MD58535ef83ad230663fb31734e0b64ed07
SHA1e5ddf52ba32126319dad2324ad54878af656a10e
SHA256ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d
SHA512e351bbc61f39ef1700894f95e22c9d56780566dd5564a9e6f2943844542c12bc93cae8d459f95d0b97dcfd0f2ab26fa5ba710f8621f276be962ea96df2d53ce8
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
45KB
MD58535ef83ad230663fb31734e0b64ed07
SHA1e5ddf52ba32126319dad2324ad54878af656a10e
SHA256ebfd966cbefbd0d281c4a40b74eea33e09c60df987a7cd9df57528438f9db14d
SHA512e351bbc61f39ef1700894f95e22c9d56780566dd5564a9e6f2943844542c12bc93cae8d459f95d0b97dcfd0f2ab26fa5ba710f8621f276be962ea96df2d53ce8
-
memory/1392-189-0x0000000000000000-mapping.dmp
-
memory/1744-180-0x0000000000000000-mapping.dmp
-
memory/1744-181-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/1744-182-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/1744-183-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/2448-204-0x0000000000000000-mapping.dmp
-
memory/3612-316-0x00000000057D0000-0x0000000005836000-memory.dmpFilesize
408KB
-
memory/3612-315-0x0000000005C50000-0x000000000614E000-memory.dmpFilesize
5.0MB
-
memory/3612-239-0x0000000000000000-mapping.dmp
-
memory/3692-149-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-154-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-125-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-126-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-127-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-128-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-129-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-130-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-131-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-132-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-133-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-134-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-135-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-136-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-137-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-138-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-139-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-140-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-141-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-142-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-143-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-144-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-145-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-146-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-147-0x00000000000F0000-0x0000000000102000-memory.dmpFilesize
72KB
-
memory/3692-148-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-123-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-150-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-151-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-152-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-153-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-124-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-155-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-156-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-157-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-158-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-159-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-160-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-162-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-161-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-163-0x0000000004C40000-0x0000000004CDC000-memory.dmpFilesize
624KB
-
memory/3692-164-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-165-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-166-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-167-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-168-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-169-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-170-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-171-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-172-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-173-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-174-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-122-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-121-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-120-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-119-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-118-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-117-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3692-116-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/4044-175-0x0000000000000000-mapping.dmp
-
memory/4044-176-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/4044-177-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/4044-179-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/4044-178-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB