Analysis
-
max time kernel
77s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 10:03
Static task
static1
Behavioral task
behavioral1
Sample
273f2c55c1982fc3ec6450639609f38a.exe
Resource
win7-20220414-en
General
-
Target
273f2c55c1982fc3ec6450639609f38a.exe
-
Size
486KB
-
MD5
273f2c55c1982fc3ec6450639609f38a
-
SHA1
02db2875babca34c81f4979134cba8422c7ef262
-
SHA256
93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018
-
SHA512
a65de5f5bf0f47c399108f6b59405327be7a1037a2b6597a5eef4b13c3483347885a86a6662770bd34a8aea61445ac29cab93e330739453922dcbacf7b743e38
Malware Config
Extracted
asyncrat
0.5.7B
Default
vivald21.hopto.org:9954
63.141.237.188:9954
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1412-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1412-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1412-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1412-71-0x000000000040D09E-mapping.dmp asyncrat behavioral1/memory/1412-75-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1412-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exedescription pid process target process PID 1756 set thread context of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exepowershell.exepid process 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1756 273f2c55c1982fc3ec6450639609f38a.exe 1996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exepowershell.exe273f2c55c1982fc3ec6450639609f38a.exedescription pid process Token: SeDebugPrivilege 1756 273f2c55c1982fc3ec6450639609f38a.exe Token: SeDebugPrivilege 1996 powershell.exe Token: SeDebugPrivilege 1412 273f2c55c1982fc3ec6450639609f38a.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exedescription pid process target process PID 1756 wrote to memory of 1996 1756 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 1756 wrote to memory of 1996 1756 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 1756 wrote to memory of 1996 1756 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 1756 wrote to memory of 1996 1756 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 1756 wrote to memory of 1764 1756 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 1756 wrote to memory of 1764 1756 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 1756 wrote to memory of 1764 1756 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 1756 wrote to memory of 1764 1756 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 1756 wrote to memory of 524 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 524 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 524 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 524 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 1756 wrote to memory of 1412 1756 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mqJGmcQXQtGbX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mqJGmcQXQtGbX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFEBA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFEBA.tmpFilesize
1KB
MD541290d202948073ec101a8feab825055
SHA12b48fd23f19f9dab1fdababcba0342ac38b9f188
SHA256dbe47d83f759900a3030b8103cd02a5bf1f944ebf6521d82985cdd29fa4f68cf
SHA51244e61fe675d98e966a1edc161b193175e5c8b9fb927ec45bcb2c67f148f2b482d1fe77c492821cb3f7efb51c7f631dd3ad85cf5e3371a5d440e405e08bbc3869
-
memory/1412-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1412-71-0x000000000040D09E-mapping.dmp
-
memory/1756-57-0x00000000003D0000-0x00000000003E6000-memory.dmpFilesize
88KB
-
memory/1756-56-0x0000000000370000-0x0000000000386000-memory.dmpFilesize
88KB
-
memory/1756-58-0x00000000005A0000-0x00000000005AA000-memory.dmpFilesize
40KB
-
memory/1756-54-0x0000000000180000-0x0000000000200000-memory.dmpFilesize
512KB
-
memory/1756-55-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1756-59-0x0000000004450000-0x00000000044AC000-memory.dmpFilesize
368KB
-
memory/1756-64-0x0000000002280000-0x0000000002292000-memory.dmpFilesize
72KB
-
memory/1764-61-0x0000000000000000-mapping.dmp
-
memory/1996-76-0x000000006E770000-0x000000006ED1B000-memory.dmpFilesize
5.7MB
-
memory/1996-60-0x0000000000000000-mapping.dmp