Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220414-en
General
-
Target
tmp.exe
-
Size
836KB
-
MD5
3578aaa113d7683b85fc0768f816dafb
-
SHA1
1e362280a1d800d7ea999370aac20c883eefb517
-
SHA256
666b7cd211ead3bc4fc8ff1e480a73ab9cb8ecf678e31991f5d6269b00282087
-
SHA512
bb33fa86a42f823d58d844b249893f9a0e7e139d41368f110d4dcc882341f91c5b9921b56352a9f516c13e3fe3799fb067677229cec6f368ae9e684299d18630
Malware Config
Extracted
asyncrat
ANC8.0
Default
frp1.freefrp.net:37898
MUTEX
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1172-4579-0x0000000000400000-0x00000000004EC000-memory.dmp asyncrat -
Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
Processes:
tmp.exepid process 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe 1172 tmp.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-54-0x0000000075261000-0x0000000075263000-memory.dmpFilesize
8KB
-
memory/1172-56-0x0000000076070000-0x00000000760B7000-memory.dmpFilesize
284KB
-
memory/1172-463-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-464-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-465-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-466-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-467-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-468-0x0000000000400000-0x00000000004EC000-memory.dmpFilesize
944KB
-
memory/1172-470-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-469-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-471-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-472-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-473-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-474-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-475-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-476-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-477-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-478-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-479-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-480-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-482-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-481-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-483-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-484-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-485-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-486-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-487-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-488-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-489-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-490-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-491-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-492-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-493-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-494-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-496-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-495-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-497-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-498-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-499-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-500-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-502-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-501-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-504-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-503-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-505-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-507-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-506-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-508-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-509-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-510-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-511-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-512-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-513-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-514-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-515-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-516-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-517-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-518-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-519-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-520-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-521-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-522-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-525-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-523-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-524-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-1567-0x00000000004F0000-0x00000000005F0000-memory.dmpFilesize
1024KB
-
memory/1172-1569-0x0000000001E90000-0x0000000002011000-memory.dmpFilesize
1.5MB
-
memory/1172-4580-0x00000000021E0000-0x00000000022F1000-memory.dmpFilesize
1.1MB
-
memory/1172-4579-0x0000000000400000-0x00000000004EC000-memory.dmpFilesize
944KB
-
memory/1172-4581-0x0000000002410000-0x00000000024B1000-memory.dmpFilesize
644KB
-
memory/1172-4582-0x0000000002300000-0x0000000002401000-memory.dmpFilesize
1.0MB
-
memory/1172-4583-0x00000000004F0000-0x00000000005F0000-memory.dmpFilesize
1024KB