Analysis
-
max time kernel
39s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2022 20:34
Static task
static1
Behavioral task
behavioral1
Sample
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe
Resource
win10v2004-20220812-en
General
-
Target
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe
-
Size
70KB
-
MD5
198a692570d1a3197a7b82d5010ff135
-
SHA1
757965d8c9f119e87a224f0a8a55fc7cd9225f71
-
SHA256
f605416a4abce35b85ce6d88b370e7bec3c012772a0eb35c70e4f5aa0cdc9b3d
-
SHA512
3572fac7eae731cc7499cd9baac1e98b092dd96237352807a659a3890f1a91338ee10a7d25668e98891c3e06d3b3c3354aba63a775100be5007c4584ea57c948
-
SSDEEP
1536:Okc5mbE6TWogwg5wy74WcMX662ho4zdSmhFNhHMUC:Okc5mbEYWog35T4SXEhzcA3hH7C
Malware Config
Extracted
asyncrat
0.5.7A
Default
163.172.225.185:6606
163.172.225.185:7707
163.172.225.185:8808
163.172.225.185:551
163.172.225.185:677
163.172.225.185:441
163.172.225.185:661
163.172.225.185:412
iurufubmszrrcclmx
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-141-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Arhjvlk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tnszqkuc\\Arhjvlk.exe\"" F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exedescription pid process target process PID 2840 set thread context of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exepid process 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe Token: SeDebugPrivilege 4928 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exedescription pid process target process PID 2840 wrote to memory of 4384 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4384 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4384 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe PID 2840 wrote to memory of 4928 2840 F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe"C:\Users\Admin\AppData\Local\Temp\F605416A4ABCE35B85CE6D88B370E7BEC3C012772A0EB.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2840-132-0x00000000000A0000-0x00000000000B8000-memory.dmpFilesize
96KB
-
memory/2840-133-0x0000000005770000-0x00000000057C0000-memory.dmpFilesize
320KB
-
memory/2840-134-0x0000000005880000-0x0000000005932000-memory.dmpFilesize
712KB
-
memory/2840-135-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/2840-137-0x0000000005970000-0x0000000005992000-memory.dmpFilesize
136KB
-
memory/2840-136-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB
-
memory/2840-138-0x0000000005D10000-0x0000000005D76000-memory.dmpFilesize
408KB
-
memory/4384-139-0x0000000000000000-mapping.dmp
-
memory/4928-141-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4928-140-0x0000000000000000-mapping.dmp
-
memory/4928-142-0x0000000005BF0000-0x0000000005C8C000-memory.dmpFilesize
624KB