Analysis
-
max time kernel
42s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 08:54
Static task
static1
Behavioral task
behavioral1
Sample
a2488b9d02c16c8f4227e7657d066c47.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a2488b9d02c16c8f4227e7657d066c47.exe
-
Size
76KB
-
MD5
a2488b9d02c16c8f4227e7657d066c47
-
SHA1
de1a49fc402e04109f1549846c542cb0aa483371
-
SHA256
c96718e4f79dbc5e868f55720c77af071011de9b7dbd239243cc8a8604235822
-
SHA512
2771ae5cc4b024750c76528cf5a678af44d56950663a859a36aaa5d0bedacd39a65a7a1e10197511a5b0ae7cd803ddfc0f8d18956b418b2a6eb4f20a0829713c
-
SSDEEP
1536:/wwwmEsKq68kCKQtkGtJaYDxG+wlDOFjZNIduA/F4Ro9:/wwwmEsKq68kCKQtkG/aoE+ODgjZN0uc
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
drax
C2
azazws6606.linkpc.net:6606
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1296-58-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1296-59-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1296-61-0x000000000040C74E-mapping.dmp asyncrat behavioral1/memory/1296-63-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1296-62-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1296-67-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1296-70-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a2488b9d02c16c8f4227e7657d066c47.exedescription pid process target process PID 1132 set thread context of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 1296 vbc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a2488b9d02c16c8f4227e7657d066c47.exedescription pid process target process PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe PID 1132 wrote to memory of 1296 1132 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2488b9d02c16c8f4227e7657d066c47.exe"C:\Users\Admin\AppData\Local\Temp\a2488b9d02c16c8f4227e7657d066c47.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1132-54-0x0000000000150000-0x000000000016A000-memory.dmpFilesize
104KB
-
memory/1296-55-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-56-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-58-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-59-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-61-0x000000000040C74E-mapping.dmp
-
memory/1296-63-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-62-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-67-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-70-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1296-71-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB