Analysis

  • max time kernel
    169s
  • max time network
    178s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 09:01

General

  • Target

    CIRCULAR PROCESO REQUERIMIENTO BBVA #20012452 CODIGO DE VERIFICACION 8005241561ff1565465a4564164654d.exe

  • Size

    1.5MB

  • MD5

    bed6117693dadb458cf4686b87a7e753

  • SHA1

    b8f242faa45a641e2b1fa4237abb3d9f12e680b3

  • SHA256

    afaed2a9b59964e7fcf1bcfdf4f1dcb0ac299875c27c0e699277d5326340bdb3

  • SHA512

    b2370de67e8cc280de94b274fb3ed4fb960fe9ba45d5aa820adb1a806a0ee37a0d7ee1e1c8debd3f62c210197ffefec47e2640fcbe00fdac5d302dae2138b7a3

  • SSDEEP

    49152:UIliPPEPPPPPPPPPAPPPPPPPPPPPPPPPPoPPPPPPPPPPPPPPPPPPuPPPPPPPPPPI:Jlk4

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CIRCULAR PROCESO REQUERIMIENTO BBVA #20012452 CODIGO DE VERIFICACION 8005241561ff1565465a4564164654d.exe
    "C:\Users\Admin\AppData\Local\Temp\CIRCULAR PROCESO REQUERIMIENTO BBVA #20012452 CODIGO DE VERIFICACION 8005241561ff1565465a4564164654d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:520

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/520-68-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-66-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-73-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-71-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-63-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-69-0x000000000041472E-mapping.dmp
    • memory/520-67-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/520-64-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

    • memory/780-55-0x00000000005B0000-0x0000000000658000-memory.dmp
      Filesize

      672KB

    • memory/780-54-0x0000000001090000-0x0000000001212000-memory.dmp
      Filesize

      1.5MB

    • memory/780-57-0x0000000000FE0000-0x0000000001072000-memory.dmp
      Filesize

      584KB

    • memory/780-56-0x00000000758C1000-0x00000000758C3000-memory.dmp
      Filesize

      8KB

    • memory/948-58-0x0000000000000000-mapping.dmp
    • memory/948-61-0x000000006F990000-0x000000006FF3B000-memory.dmp
      Filesize

      5.7MB

    • memory/948-62-0x000000006F990000-0x000000006FF3B000-memory.dmp
      Filesize

      5.7MB

    • memory/948-60-0x000000006F990000-0x000000006FF3B000-memory.dmp
      Filesize

      5.7MB