Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-07-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220414-en
General
-
Target
tmp.exe
-
Size
73KB
-
MD5
e8032d887188081e383a6ebd6dbcd33a
-
SHA1
ccbd2b7b1dc9688098636bf4a778ae1e5e90dd17
-
SHA256
6fc5883456ca655a74a91c3127486ab5c21186308fdebfca4ec9035e09d7069a
-
SHA512
21babd4ff02d906274256c9a6defd85843f08d56a863c4f127f873652cb9b6205e13c581e6eed4ef51f617b4b85efcd87c7473398712131e21ace792fb235060
Malware Config
Extracted
asyncrat
0.5.7B
Default
vivald21.hopto.org:9954
63.141.237.188:9954
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4588-148-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tej = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\tej.exe\"" tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 2248 set thread context of 4588 2248 tmp.exe tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exetmp.exepid process 3340 powershell.exe 3340 powershell.exe 2056 powershell.exe 2056 powershell.exe 2248 tmp.exe 2248 tmp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exetmp.exepowershell.exetmp.exedescription pid process Token: SeDebugPrivilege 3340 powershell.exe Token: SeDebugPrivilege 2248 tmp.exe Token: SeDebugPrivilege 2056 powershell.exe Token: SeDebugPrivilege 4588 tmp.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
tmp.exedescription pid process target process PID 2248 wrote to memory of 3340 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 3340 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 3340 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 2056 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 2056 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 2056 2248 tmp.exe powershell.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe PID 2248 wrote to memory of 4588 2248 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.logFilesize
1KB
MD57ebe314bf617dc3e48b995a6c352740c
SHA1538f643b7b30f9231a3035c448607f767527a870
SHA25648178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
SHA5120ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
memory/2056-145-0x0000000000000000-mapping.dmp
-
memory/2248-131-0x0000000005D10000-0x00000000062B4000-memory.dmpFilesize
5.6MB
-
memory/2248-132-0x0000000005630000-0x00000000056C2000-memory.dmpFilesize
584KB
-
memory/2248-133-0x0000000005610000-0x000000000561A000-memory.dmpFilesize
40KB
-
memory/2248-130-0x0000000000C50000-0x0000000000C68000-memory.dmpFilesize
96KB
-
memory/3340-135-0x0000000004980000-0x00000000049B6000-memory.dmpFilesize
216KB
-
memory/3340-144-0x00000000072E0000-0x00000000072FA000-memory.dmpFilesize
104KB
-
memory/3340-139-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/3340-140-0x0000000005F50000-0x0000000005F6E000-memory.dmpFilesize
120KB
-
memory/3340-141-0x0000000006490000-0x00000000064D4000-memory.dmpFilesize
272KB
-
memory/3340-142-0x0000000007040000-0x00000000070B6000-memory.dmpFilesize
472KB
-
memory/3340-143-0x0000000007940000-0x0000000007FBA000-memory.dmpFilesize
6.5MB
-
memory/3340-138-0x0000000005750000-0x00000000057B6000-memory.dmpFilesize
408KB
-
memory/3340-137-0x0000000004E80000-0x0000000004EA2000-memory.dmpFilesize
136KB
-
memory/3340-136-0x0000000004FF0000-0x0000000005618000-memory.dmpFilesize
6.2MB
-
memory/3340-134-0x0000000000000000-mapping.dmp
-
memory/4588-148-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4588-147-0x0000000000000000-mapping.dmp
-
memory/4588-150-0x0000000006030000-0x00000000060CC000-memory.dmpFilesize
624KB