Analysis
-
max time kernel
72s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 04:41
Static task
static1
Behavioral task
behavioral1
Sample
P.O#07072022.exe
Resource
win7-20220414-en
General
-
Target
P.O#07072022.exe
-
Size
607KB
-
MD5
9b24112df18f585a70270a72b564125f
-
SHA1
e51d61eef365ba0095267e5806743625c2291baf
-
SHA256
724b0ad46f22cbce63245e2e819e244e606e5081bd4cad054523a2c5fefd6cc3
-
SHA512
1abb3a7a98df0b2a850f46d14de42e961da19699d68e06d1d0417b0695b71b9d0b790e25664c48451d2a52bc11a494c7e8b4b8da887d0e9f7cc8311a8f5c5d4a
Malware Config
Extracted
asyncrat
0.5.7B
Default
vivald21.hopto.org:25256
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/668-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/668-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/668-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/668-70-0x000000000040D05E-mapping.dmp asyncrat behavioral1/memory/668-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/668-74-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
P.O#07072022.exedescription pid process target process PID 1600 set thread context of 668 1600 P.O#07072022.exe P.O#07072022.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
P.O#07072022.exepowershell.exepid process 1600 P.O#07072022.exe 1600 P.O#07072022.exe 1600 P.O#07072022.exe 1600 P.O#07072022.exe 1600 P.O#07072022.exe 1600 P.O#07072022.exe 1204 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
P.O#07072022.exepowershell.exeP.O#07072022.exedescription pid process Token: SeDebugPrivilege 1600 P.O#07072022.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 668 P.O#07072022.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
P.O#07072022.exedescription pid process target process PID 1600 wrote to memory of 1204 1600 P.O#07072022.exe powershell.exe PID 1600 wrote to memory of 1204 1600 P.O#07072022.exe powershell.exe PID 1600 wrote to memory of 1204 1600 P.O#07072022.exe powershell.exe PID 1600 wrote to memory of 1204 1600 P.O#07072022.exe powershell.exe PID 1600 wrote to memory of 2012 1600 P.O#07072022.exe schtasks.exe PID 1600 wrote to memory of 2012 1600 P.O#07072022.exe schtasks.exe PID 1600 wrote to memory of 2012 1600 P.O#07072022.exe schtasks.exe PID 1600 wrote to memory of 2012 1600 P.O#07072022.exe schtasks.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe PID 1600 wrote to memory of 668 1600 P.O#07072022.exe P.O#07072022.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P.O#07072022.exe"C:\Users\Admin\AppData\Local\Temp\P.O#07072022.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sQtnenEXHD.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sQtnenEXHD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF30.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\P.O#07072022.exe"C:\Users\Admin\AppData\Local\Temp\P.O#07072022.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEF30.tmpFilesize
1KB
MD5b441ae6688380143fd4f578ef4f10f0e
SHA100ef978ca7463b92d6b166e69b63f4574a06b290
SHA25601402df702394945ba395497190fd1e76e8802222ad2f4cc9af32c71862ed3e2
SHA5125e2a4db09d0e2895083968d370f29f0e122da3ba9b59cb93145730141d96d2c23092d43455e8a6593ded91940c634928d0a0ba8399968d78fc461b3ac976cf7a
-
memory/668-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-70-0x000000000040D05E-mapping.dmp
-
memory/668-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/668-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1204-75-0x000000006EA30000-0x000000006EFDB000-memory.dmpFilesize
5.7MB
-
memory/1204-59-0x0000000000000000-mapping.dmp
-
memory/1600-58-0x0000000005190000-0x00000000051EC000-memory.dmpFilesize
368KB
-
memory/1600-63-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/1600-54-0x0000000000FB0000-0x000000000104E000-memory.dmpFilesize
632KB
-
memory/1600-57-0x0000000000AD0000-0x0000000000ADE000-memory.dmpFilesize
56KB
-
memory/1600-56-0x0000000000480000-0x00000000004A0000-memory.dmpFilesize
128KB
-
memory/1600-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/2012-60-0x0000000000000000-mapping.dmp