Analysis

  • max time kernel
    73s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2022 19:41

General

  • Target

    1590B1512142D6C974828FC11958A9A5FFDB6673A584B.exe

  • Size

    309KB

  • MD5

    f4e3415d68ba7564f1400b74e4d7e22b

  • SHA1

    a4a3b80c28db771c0b15c543daa56a229467fdf3

  • SHA256

    1590b1512142d6c974828fc11958a9a5ffdb6673a584b15fda7f93768f639a54

  • SHA512

    8c1a0d8db17301bdc6e2e3c16f953c1fd69ba76e887c797d64eb952155dc204a11b8f04181207cae7723aebddf638031e96225131a2006d07c43eb0555f207d7

  • SSDEEP

    6144:h8u3J4+CQ6otk3BPuzoqANdyl6/5rLlj/T+/1aoaorg9v4EqP4EXPav0XXXXX3hM:0K1aoaCgR4HP4KPHXXXXX3hXXXXXX3Xs

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Attributes
delay
8
install
true
install_file
folders.exe
install_folder
%AppData%
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload ⋅ 2 IoCs
  • Executes dropped EXE ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1590B1512142D6C974828FC11958A9A5FFDB6673A584B.exe
    "C:\Users\Admin\AppData\Local\Temp\1590B1512142D6C974828FC11958A9A5FFDB6673A584B.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1590B1512142D6C974828FC11958A9A5FFDB6673A584B /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"' & exit
      Suspicious use of WriteProcessMemory
      PID:800
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /ru system /rl highest /tn 1590B1512142D6C974828FC11958A9A5FFDB6673A584B /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"'
        Creates scheduled task(s)
        PID:1752
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp81C.tmp.bat""
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        Delays execution with timeout.exe
        PID:1816
      • C:\Users\Admin\AppData\Roaming\folders.exe
        "C:\Users\Admin\AppData\Roaming\folders.exe"
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        PID:980

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmp81C.tmp.bat
                        MD5

                        5e204fdd0361227ab448137c2db7fc50

                        SHA1

                        aaef86297fd1ee0f6f8b6677512f7ebb276e5ad0

                        SHA256

                        6e319f9439be2895a8eae06580cde07cd38bcf32bbfc8c505c82c855c8344e1f

                        SHA512

                        8fe1ac8366f790a8f420f9e6a4ce7316aa1ae0787d18a639bd25a3516bb3d500a1d0925b1b7ad670f7fed95e35d09d51ff55285afff6f5e4994e53bb875e404a

                      • C:\Users\Admin\AppData\Roaming\folders.exe
                        MD5

                        f4e3415d68ba7564f1400b74e4d7e22b

                        SHA1

                        a4a3b80c28db771c0b15c543daa56a229467fdf3

                        SHA256

                        1590b1512142d6c974828fc11958a9a5ffdb6673a584b15fda7f93768f639a54

                        SHA512

                        8c1a0d8db17301bdc6e2e3c16f953c1fd69ba76e887c797d64eb952155dc204a11b8f04181207cae7723aebddf638031e96225131a2006d07c43eb0555f207d7

                      • C:\Users\Admin\AppData\Roaming\folders.exe
                        MD5

                        f4e3415d68ba7564f1400b74e4d7e22b

                        SHA1

                        a4a3b80c28db771c0b15c543daa56a229467fdf3

                        SHA256

                        1590b1512142d6c974828fc11958a9a5ffdb6673a584b15fda7f93768f639a54

                        SHA512

                        8c1a0d8db17301bdc6e2e3c16f953c1fd69ba76e887c797d64eb952155dc204a11b8f04181207cae7723aebddf638031e96225131a2006d07c43eb0555f207d7

                      • \Users\Admin\AppData\Roaming\folders.exe
                        MD5

                        f4e3415d68ba7564f1400b74e4d7e22b

                        SHA1

                        a4a3b80c28db771c0b15c543daa56a229467fdf3

                        SHA256

                        1590b1512142d6c974828fc11958a9a5ffdb6673a584b15fda7f93768f639a54

                        SHA512

                        8c1a0d8db17301bdc6e2e3c16f953c1fd69ba76e887c797d64eb952155dc204a11b8f04181207cae7723aebddf638031e96225131a2006d07c43eb0555f207d7

                      • \Users\Admin\AppData\Roaming\folders.exe
                        MD5

                        f4e3415d68ba7564f1400b74e4d7e22b

                        SHA1

                        a4a3b80c28db771c0b15c543daa56a229467fdf3

                        SHA256

                        1590b1512142d6c974828fc11958a9a5ffdb6673a584b15fda7f93768f639a54

                        SHA512

                        8c1a0d8db17301bdc6e2e3c16f953c1fd69ba76e887c797d64eb952155dc204a11b8f04181207cae7723aebddf638031e96225131a2006d07c43eb0555f207d7

                      • memory/800-58-0x0000000000000000-mapping.dmp
                      • memory/952-60-0x0000000000000000-mapping.dmp
                      • memory/980-66-0x0000000000000000-mapping.dmp
                      • memory/980-68-0x0000000000F00000-0x0000000000F54000-memory.dmp
                      • memory/980-70-0x0000000000570000-0x0000000000582000-memory.dmp
                      • memory/1096-54-0x0000000000D90000-0x0000000000DE4000-memory.dmp
                      • memory/1096-57-0x00000000003B0000-0x00000000003C2000-memory.dmp
                      • memory/1096-56-0x0000000000200000-0x0000000000210000-memory.dmp
                      • memory/1096-55-0x00000000768A1000-0x00000000768A3000-memory.dmp
                      • memory/1752-59-0x0000000000000000-mapping.dmp
                      • memory/1816-62-0x0000000000000000-mapping.dmp