Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 10:03
Static task
static1
Behavioral task
behavioral1
Sample
273f2c55c1982fc3ec6450639609f38a.exe
Resource
win7-20220414-en
General
-
Target
273f2c55c1982fc3ec6450639609f38a.exe
-
Size
486KB
-
MD5
273f2c55c1982fc3ec6450639609f38a
-
SHA1
02db2875babca34c81f4979134cba8422c7ef262
-
SHA256
93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018
-
SHA512
a65de5f5bf0f47c399108f6b59405327be7a1037a2b6597a5eef4b13c3483347885a86a6662770bd34a8aea61445ac29cab93e330739453922dcbacf7b743e38
Malware Config
Extracted
asyncrat
0.5.7B
Default
vivald21.hopto.org:9954
63.141.237.188:9954
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/404-142-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
273f2c55c1982fc3ec6450639609f38a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 273f2c55c1982fc3ec6450639609f38a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exedescription pid process target process PID 4704 set thread context of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exepowershell.exepid process 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 4704 273f2c55c1982fc3ec6450639609f38a.exe 1744 powershell.exe 1744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exepowershell.exe273f2c55c1982fc3ec6450639609f38a.exedescription pid process Token: SeDebugPrivilege 4704 273f2c55c1982fc3ec6450639609f38a.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeDebugPrivilege 404 273f2c55c1982fc3ec6450639609f38a.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
273f2c55c1982fc3ec6450639609f38a.exedescription pid process target process PID 4704 wrote to memory of 1744 4704 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 4704 wrote to memory of 1744 4704 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 4704 wrote to memory of 1744 4704 273f2c55c1982fc3ec6450639609f38a.exe powershell.exe PID 4704 wrote to memory of 4832 4704 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 4704 wrote to memory of 4832 4704 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 4704 wrote to memory of 4832 4704 273f2c55c1982fc3ec6450639609f38a.exe schtasks.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe PID 4704 wrote to memory of 404 4704 273f2c55c1982fc3ec6450639609f38a.exe 273f2c55c1982fc3ec6450639609f38a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mqJGmcQXQtGbX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mqJGmcQXQtGbX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB2B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"C:\Users\Admin\AppData\Local\Temp\273f2c55c1982fc3ec6450639609f38a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\273f2c55c1982fc3ec6450639609f38a.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
C:\Users\Admin\AppData\Local\Temp\tmpEB2B.tmpFilesize
1KB
MD5393efdea5a2c553ae26b10f4331dad59
SHA10437bd9fccd96e1e2f58abf6cdbe73579e06b306
SHA25688a9094e1f991ad09a7ac8971fe5d5940a8fbd6cd1bc764305ed7db00d3b6edb
SHA51209b801269ab6f47137d242f2fdd9dda7324a2c32c7d2de69c0b3ed0794c09a9501c62d0ea890580ee1c91ad963127090d3eb0613e9250c720bb12dad8cbe3dbd
-
memory/404-142-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/404-141-0x0000000000000000-mapping.dmp
-
memory/1744-136-0x0000000000000000-mapping.dmp
-
memory/1744-145-0x00000000056F0000-0x0000000005756000-memory.dmpFilesize
408KB
-
memory/1744-156-0x0000000007DB0000-0x0000000007DB8000-memory.dmpFilesize
32KB
-
memory/1744-155-0x0000000007DD0000-0x0000000007DEA000-memory.dmpFilesize
104KB
-
memory/1744-138-0x0000000002DE0000-0x0000000002E16000-memory.dmpFilesize
216KB
-
memory/1744-154-0x0000000007CC0000-0x0000000007CCE000-memory.dmpFilesize
56KB
-
memory/1744-140-0x00000000058B0000-0x0000000005ED8000-memory.dmpFilesize
6.2MB
-
memory/1744-153-0x0000000007D10000-0x0000000007DA6000-memory.dmpFilesize
600KB
-
memory/1744-152-0x0000000007B00000-0x0000000007B0A000-memory.dmpFilesize
40KB
-
memory/1744-151-0x0000000007A90000-0x0000000007AAA000-memory.dmpFilesize
104KB
-
memory/1744-144-0x0000000005650000-0x0000000005672000-memory.dmpFilesize
136KB
-
memory/1744-150-0x00000000080E0000-0x000000000875A000-memory.dmpFilesize
6.5MB
-
memory/1744-146-0x0000000006780000-0x000000000679E000-memory.dmpFilesize
120KB
-
memory/1744-147-0x0000000006D70000-0x0000000006DA2000-memory.dmpFilesize
200KB
-
memory/1744-148-0x0000000071540000-0x000000007158C000-memory.dmpFilesize
304KB
-
memory/1744-149-0x0000000006D20000-0x0000000006D3E000-memory.dmpFilesize
120KB
-
memory/4704-135-0x0000000000A20000-0x0000000000A86000-memory.dmpFilesize
408KB
-
memory/4704-131-0x0000000005070000-0x0000000005614000-memory.dmpFilesize
5.6MB
-
memory/4704-132-0x0000000004B60000-0x0000000004BF2000-memory.dmpFilesize
584KB
-
memory/4704-133-0x0000000004AE0000-0x0000000004AEA000-memory.dmpFilesize
40KB
-
memory/4704-134-0x0000000008A10000-0x0000000008AAC000-memory.dmpFilesize
624KB
-
memory/4704-130-0x00000000000C0000-0x0000000000140000-memory.dmpFilesize
512KB
-
memory/4832-137-0x0000000000000000-mapping.dmp