Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 11:14

General

  • Target

    528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe

  • Size

    145KB

  • MD5

    da3326025a075eaba1f6b3d774efa8ad

  • SHA1

    190b0825b184f64e1aaf809ecf9c38e64161ba39

  • SHA256

    528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914

  • SHA512

    97b462223fca81ceeb1274b0611ce47a63cab408c715db2f505d3310f33cb889d0b9df615f066110c7e3d8a46711a60dee0175b9e15dd4a69ef2bfbd58849b96

  • SSDEEP

    1536:ZOH8UxIs9UypeZR21/RIa7cqO12vT0HqZTPmMg+nXJGGSjln06Uj3jnbfxGhrs:ZOceT1/R57O12vYHeUuQpNe3jbfsh4

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.154.98.214:6606

Attributes
delay
3
install
false
install_folder
%AppData%
aes.plain

Extracted

Family

redline

Botnet

fud

C2

45.15.156.7:48638

Attributes
auth_value
da2faefdcf53c9d85fcbb82d0cbf4876

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Detects Smokeloader packer ⋅ 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload ⋅ 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Async RAT payload ⋅ 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 6 IoCs
  • Checks computer location settings ⋅ 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution ⋅ 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 1 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 19 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 40 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe
    "C:\Users\Admin\AppData\Local\Temp\528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe"
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:4544
  • C:\Users\Admin\AppData\Local\Temp\CFE7.exe
    C:\Users\Admin\AppData\Local\Temp\CFE7.exe
    Executes dropped EXE
    Suspicious use of AdjustPrivilegeToken
    PID:3136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1264
      Program crash
      PID:1592
  • C:\Users\Admin\AppData\Local\Temp\D382.exe
    C:\Users\Admin\AppData\Local\Temp\D382.exe
    Executes dropped EXE
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
      Suspicious use of AdjustPrivilegeToken
      PID:4592
    • C:\Users\Admin\AppData\Local\Temp\D382.exe
      C:\Users\Admin\AppData\Local\Temp\D382.exe
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4880
  • C:\Users\Admin\AppData\Local\Temp\F41B.exe
    C:\Users\Admin\AppData\Local\Temp\F41B.exe
    Executes dropped EXE
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      Executes dropped EXE
      PID:4276
  • C:\Users\Admin\AppData\Local\Temp\12C.exe
    C:\Users\Admin\AppData\Local\Temp\12C.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:3972
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:440
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:2632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3136 -ip 3136
    PID:2252
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:836
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:624
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:1920
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:5036
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:2696
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:724
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:4692

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D382.exe.log
                    MD5

                    7e88081fcf716d85992bb3af3d9b6454

                    SHA1

                    2153780fbc71061b0102a7a7b665349e1013e250

                    SHA256

                    5ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2

                    SHA512

                    ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7

                  • C:\Users\Admin\AppData\Local\Temp\12C.exe
                    MD5

                    52941006f1925c25e95e35d849b5123a

                    SHA1

                    ac97512774715c70018e9275f05d41b1412e8a66

                    SHA256

                    3e8378da9f1da38db2095a8683e2c1a2b8ceb0fab6a029a9a75b6f60cf129509

                    SHA512

                    adf0b7d7bc460dd3022b87fb79c9774446e0b5b3b254f01c12cf16fe1b86bdf2589f5d952ef8a1de73b9629d2a950367109d344b4fb0df786dd039d7f1d63144

                  • C:\Users\Admin\AppData\Local\Temp\12C.exe
                    MD5

                    52941006f1925c25e95e35d849b5123a

                    SHA1

                    ac97512774715c70018e9275f05d41b1412e8a66

                    SHA256

                    3e8378da9f1da38db2095a8683e2c1a2b8ceb0fab6a029a9a75b6f60cf129509

                    SHA512

                    adf0b7d7bc460dd3022b87fb79c9774446e0b5b3b254f01c12cf16fe1b86bdf2589f5d952ef8a1de73b9629d2a950367109d344b4fb0df786dd039d7f1d63144

                  • C:\Users\Admin\AppData\Local\Temp\CFE7.exe
                    MD5

                    5a9fd5240f5f626063abda8b483bd429

                    SHA1

                    476d48e02c8a80bd0cdfae683d25fdeeb100b19a

                    SHA256

                    df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f

                    SHA512

                    cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d

                  • C:\Users\Admin\AppData\Local\Temp\CFE7.exe
                    MD5

                    5a9fd5240f5f626063abda8b483bd429

                    SHA1

                    476d48e02c8a80bd0cdfae683d25fdeeb100b19a

                    SHA256

                    df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f

                    SHA512

                    cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d

                  • C:\Users\Admin\AppData\Local\Temp\D382.exe
                    MD5

                    c6f4ffde851054ec2871e72833cd9d59

                    SHA1

                    e688103c4fa3ca815732f0f70f37d11f69232e04

                    SHA256

                    25502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7

                    SHA512

                    47264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4

                  • C:\Users\Admin\AppData\Local\Temp\D382.exe
                    MD5

                    c6f4ffde851054ec2871e72833cd9d59

                    SHA1

                    e688103c4fa3ca815732f0f70f37d11f69232e04

                    SHA256

                    25502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7

                    SHA512

                    47264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4

                  • C:\Users\Admin\AppData\Local\Temp\D382.exe
                    MD5

                    c6f4ffde851054ec2871e72833cd9d59

                    SHA1

                    e688103c4fa3ca815732f0f70f37d11f69232e04

                    SHA256

                    25502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7

                    SHA512

                    47264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4

                  • C:\Users\Admin\AppData\Local\Temp\F41B.exe
                    MD5

                    2955a7fdcda8c0768d106b135a352173

                    SHA1

                    1de1f74183421d4f811af2dc469840c8d266eec9

                    SHA256

                    3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f

                    SHA512

                    c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb

                  • C:\Users\Admin\AppData\Local\Temp\F41B.exe
                    MD5

                    2955a7fdcda8c0768d106b135a352173

                    SHA1

                    1de1f74183421d4f811af2dc469840c8d266eec9

                    SHA256

                    3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f

                    SHA512

                    c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb

                  • C:\Windows\Temp\1.exe
                    MD5

                    4a32a16c5a3c79ade487c098ee71a2be

                    SHA1

                    414b203eeb20ac7e74316fd2877ca4ebf52193df

                    SHA256

                    61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4

                    SHA512

                    6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5

                  • C:\Windows\Temp\1.exe
                    MD5

                    4a32a16c5a3c79ade487c098ee71a2be

                    SHA1

                    414b203eeb20ac7e74316fd2877ca4ebf52193df

                    SHA256

                    61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4

                    SHA512

                    6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5

                  • memory/260-143-0x0000000005760000-0x0000000005782000-memory.dmp
                  • memory/260-139-0x0000000000000000-mapping.dmp
                  • memory/260-142-0x0000000000B80000-0x0000000000C30000-memory.dmp
                  • memory/440-208-0x0000000000A70000-0x0000000000A77000-memory.dmp
                  • memory/440-176-0x0000000000000000-mapping.dmp
                  • memory/440-177-0x0000000000A70000-0x0000000000A77000-memory.dmp
                  • memory/440-178-0x0000000000A60000-0x0000000000A6B000-memory.dmp
                  • memory/624-191-0x0000000000C90000-0x0000000000C96000-memory.dmp
                  • memory/624-211-0x0000000000C90000-0x0000000000C96000-memory.dmp
                  • memory/624-190-0x0000000000000000-mapping.dmp
                  • memory/624-192-0x0000000000C80000-0x0000000000C8C000-memory.dmp
                  • memory/724-204-0x0000000000830000-0x000000000083D000-memory.dmp
                  • memory/724-203-0x0000000000840000-0x0000000000847000-memory.dmp
                  • memory/724-202-0x0000000000000000-mapping.dmp
                  • memory/724-215-0x0000000000840000-0x0000000000847000-memory.dmp
                  • memory/836-189-0x0000000000360000-0x0000000000369000-memory.dmp
                  • memory/836-185-0x0000000000000000-mapping.dmp
                  • memory/836-210-0x0000000000370000-0x0000000000375000-memory.dmp
                  • memory/836-188-0x0000000000370000-0x0000000000375000-memory.dmp
                  • memory/1920-195-0x0000000000B00000-0x0000000000B27000-memory.dmp
                  • memory/1920-193-0x0000000000000000-mapping.dmp
                  • memory/1920-212-0x0000000000B30000-0x0000000000B52000-memory.dmp
                  • memory/1920-194-0x0000000000B30000-0x0000000000B52000-memory.dmp
                  • memory/2632-209-0x0000000000BA0000-0x0000000000BA9000-memory.dmp
                  • memory/2632-181-0x0000000000B90000-0x0000000000B9F000-memory.dmp
                  • memory/2632-180-0x0000000000BA0000-0x0000000000BA9000-memory.dmp
                  • memory/2632-179-0x0000000000000000-mapping.dmp
                  • memory/2696-199-0x0000000000000000-mapping.dmp
                  • memory/2696-200-0x0000000000CD0000-0x0000000000CD6000-memory.dmp
                  • memory/2696-214-0x0000000000CD0000-0x0000000000CD6000-memory.dmp
                  • memory/2696-201-0x0000000000CC0000-0x0000000000CCB000-memory.dmp
                  • memory/3064-182-0x0000000005900000-0x000000000599C000-memory.dmp
                  • memory/3064-175-0x0000000000450000-0x0000000000458000-memory.dmp
                  • memory/3064-172-0x0000000000000000-mapping.dmp
                  • memory/3136-154-0x00000000050A0000-0x00000000056B8000-memory.dmp
                  • memory/3136-156-0x0000000005750000-0x000000000585A000-memory.dmp
                  • memory/3136-170-0x0000000006610000-0x00000000067D2000-memory.dmp
                  • memory/3136-153-0x0000000000400000-0x0000000000470000-memory.dmp
                  • memory/3136-152-0x0000000002070000-0x00000000020A8000-memory.dmp
                  • memory/3136-151-0x00000000005D0000-0x00000000005FA000-memory.dmp
                  • memory/3136-155-0x0000000005730000-0x0000000005742000-memory.dmp
                  • memory/3136-163-0x0000000006450000-0x00000000064A0000-memory.dmp
                  • memory/3136-186-0x00000000005D0000-0x00000000005FA000-memory.dmp
                  • memory/3136-187-0x0000000000400000-0x0000000000470000-memory.dmp
                  • memory/3136-162-0x00000000063C0000-0x00000000063DE000-memory.dmp
                  • memory/3136-161-0x0000000006340000-0x00000000063B6000-memory.dmp
                  • memory/3136-160-0x0000000005B80000-0x0000000005C12000-memory.dmp
                  • memory/3136-136-0x0000000000000000-mapping.dmp
                  • memory/3136-150-0x0000000004A80000-0x0000000005024000-memory.dmp
                  • memory/3136-157-0x0000000005880000-0x00000000058BC000-memory.dmp
                  • memory/3136-171-0x00000000067E0000-0x0000000006D0C000-memory.dmp
                  • memory/3972-184-0x0000000000400000-0x0000000000412000-memory.dmp
                  • memory/3972-183-0x0000000000000000-mapping.dmp
                  • memory/4020-164-0x0000000000000000-mapping.dmp
                  • memory/4276-167-0x0000000000000000-mapping.dmp
                  • memory/4544-132-0x000000000066D000-0x000000000067D000-memory.dmp
                  • memory/4544-135-0x0000000000400000-0x0000000000580000-memory.dmp
                  • memory/4544-133-0x0000000000640000-0x0000000000649000-memory.dmp
                  • memory/4544-134-0x0000000000400000-0x0000000000580000-memory.dmp
                  • memory/4592-146-0x0000000005110000-0x0000000005738000-memory.dmp
                  • memory/4592-144-0x0000000000000000-mapping.dmp
                  • memory/4592-158-0x0000000007530000-0x0000000007BAA000-memory.dmp
                  • memory/4592-159-0x00000000063B0000-0x00000000063CA000-memory.dmp
                  • memory/4592-149-0x0000000005ED0000-0x0000000005EEE000-memory.dmp
                  • memory/4592-148-0x00000000058B0000-0x0000000005916000-memory.dmp
                  • memory/4592-147-0x0000000004FB0000-0x0000000005016000-memory.dmp
                  • memory/4592-145-0x0000000002920000-0x0000000002956000-memory.dmp
                  • memory/4692-207-0x0000000000B00000-0x0000000000B0B000-memory.dmp
                  • memory/4692-206-0x0000000000B10000-0x0000000000B18000-memory.dmp
                  • memory/4692-205-0x0000000000000000-mapping.dmp
                  • memory/4692-216-0x0000000000B10000-0x0000000000B18000-memory.dmp
                  • memory/4880-217-0x0000000000000000-mapping.dmp
                  • memory/4880-218-0x0000000000400000-0x0000000000428000-memory.dmp
                  • memory/5036-198-0x0000000000BD0000-0x0000000000BD9000-memory.dmp
                  • memory/5036-213-0x0000000000BE0000-0x0000000000BE5000-memory.dmp
                  • memory/5036-196-0x0000000000000000-mapping.dmp
                  • memory/5036-197-0x0000000000BE0000-0x0000000000BE5000-memory.dmp