Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 22:29
Static task
static1
Behavioral task
behavioral1
Sample
33dad047fbc03f81e8a9e63d99a7efe4.exe
Resource
win7-20220414-en
General
-
Target
33dad047fbc03f81e8a9e63d99a7efe4.exe
-
Size
502KB
-
MD5
33dad047fbc03f81e8a9e63d99a7efe4
-
SHA1
6f3ae296412b498835b5ab3e9318062f9c7d7f2f
-
SHA256
4e75cb29be96283f4f05a840c4ed6ff23ed3ff24fcf32af2845a5b187261439d
-
SHA512
9b6237231d97b8b3988c0831cf91c74f1c52f2741c319076200159a3bf5db13a4ba0e977c0c45c5df25b5608470c3d482fce36951ab29d4103b4c6441b98e4e6
Malware Config
Extracted
asyncrat
0.5.7B
Default
10.14.204.30:2022
10.14.204.30:2019
10.14.204.30:5631
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1984-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1984-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1984-68-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/1984-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1984-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1984-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
33dad047fbc03f81e8a9e63d99a7efe4.exedescription pid process target process PID 1052 set thread context of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exe33dad047fbc03f81e8a9e63d99a7efe4.exepid process 328 powershell.exe 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe33dad047fbc03f81e8a9e63d99a7efe4.exedescription pid process Token: SeDebugPrivilege 328 powershell.exe Token: SeDebugPrivilege 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
33dad047fbc03f81e8a9e63d99a7efe4.exedescription pid process target process PID 1052 wrote to memory of 328 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe powershell.exe PID 1052 wrote to memory of 328 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe powershell.exe PID 1052 wrote to memory of 328 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe powershell.exe PID 1052 wrote to memory of 328 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe powershell.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe PID 1052 wrote to memory of 1984 1052 33dad047fbc03f81e8a9e63d99a7efe4.exe 33dad047fbc03f81e8a9e63d99a7efe4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33dad047fbc03f81e8a9e63d99a7efe4.exe"C:\Users\Admin\AppData\Local\Temp\33dad047fbc03f81e8a9e63d99a7efe4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\33dad047fbc03f81e8a9e63d99a7efe4.exeC:\Users\Admin\AppData\Local\Temp\33dad047fbc03f81e8a9e63d99a7efe4.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-58-0x0000000000000000-mapping.dmp
-
memory/328-61-0x0000000070DC0000-0x000000007136B000-memory.dmpFilesize
5.7MB
-
memory/328-60-0x0000000070DC0000-0x000000007136B000-memory.dmpFilesize
5.7MB
-
memory/1052-57-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1052-54-0x00000000010B0000-0x0000000001134000-memory.dmpFilesize
528KB
-
memory/1052-56-0x0000000000D80000-0x0000000000DCC000-memory.dmpFilesize
304KB
-
memory/1052-55-0x0000000000B60000-0x0000000000BEA000-memory.dmpFilesize
552KB
-
memory/1984-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-68-0x000000000040C71E-mapping.dmp
-
memory/1984-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1984-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB