Analysis
-
max time kernel
43s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 23:02
Static task
static1
Behavioral task
behavioral1
Sample
168ee8403709fc4848328051ff819157.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
168ee8403709fc4848328051ff819157.exe
Resource
win10v2004-20220812-en
General
-
Target
168ee8403709fc4848328051ff819157.exe
-
Size
70KB
-
MD5
168ee8403709fc4848328051ff819157
-
SHA1
bf96e4267c22e283d192e34fc50ded40802ac83c
-
SHA256
bf765420bbb03b49f594002013915e508160a4efede03e051075cabad32c51b3
-
SHA512
9e86bdb6f49881fc39a1cea97047164dc02e21cb8bfc43526997840effcde497c3411bfed256fce7738f3b3a3814d1fb8f4295cec09034453aff326cf97a449c
-
SSDEEP
1536:L2pM3Poamv/TQ6MLXIRakKVyreBOPew0ikXx5utYdsOWg+7/MajDw:iW3ADXcBURL4OmikXbuuVA/Rw
Malware Config
Extracted
asyncrat
0.5.7B
Default
20.171.107.243:6606
20.171.107.243:7707
20.171.107.243:8808
rositxado.tk:6606
rositxado.tk:7707
rositxado.tk:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-65-0x000000000040DC5E-mapping.dmp asyncrat behavioral1/memory/1968-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\vlc\\HWMonitor.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
168ee8403709fc4848328051ff819157.exedescription pid process target process PID 768 set thread context of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1064 powershell.exe Token: SeDebugPrivilege 1968 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
168ee8403709fc4848328051ff819157.exedescription pid process target process PID 768 wrote to memory of 1064 768 168ee8403709fc4848328051ff819157.exe powershell.exe PID 768 wrote to memory of 1064 768 168ee8403709fc4848328051ff819157.exe powershell.exe PID 768 wrote to memory of 1064 768 168ee8403709fc4848328051ff819157.exe powershell.exe PID 768 wrote to memory of 1064 768 168ee8403709fc4848328051ff819157.exe powershell.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe PID 768 wrote to memory of 1968 768 168ee8403709fc4848328051ff819157.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\168ee8403709fc4848328051ff819157.exe"C:\Users\Admin\AppData\Local\Temp\168ee8403709fc4848328051ff819157.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor' -Value '"C:\Users\Admin\AppData\Roaming\vlc\HWMonitor.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-54-0x0000000000B60000-0x0000000000B78000-memory.dmpFilesize
96KB
-
memory/768-55-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB
-
memory/768-56-0x0000000000460000-0x0000000000476000-memory.dmpFilesize
88KB
-
memory/1064-57-0x0000000000000000-mapping.dmp
-
memory/1064-72-0x0000000074EE0000-0x000000007548B000-memory.dmpFilesize
5.7MB
-
memory/1064-71-0x0000000074EE0000-0x000000007548B000-memory.dmpFilesize
5.7MB
-
memory/1968-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-65-0x000000000040DC5E-mapping.dmp
-
memory/1968-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB