Analysis

  • max time kernel
    69s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2022 19:45

General

  • Target

    1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe

  • Size

    72KB

  • MD5

    04ffd19d0f37dbfb88183ed3a2be3e16

  • SHA1

    55fc97fab3e9bb8028d0f488bfce17b9516c503f

  • SHA256

    90636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6

  • SHA512

    c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4

  • SSDEEP

    768:QoBLMxx0Fs4G7WHNaIx2FAhQ7CbEjbegr3iS/dbR8kClZN2tYcFmVc6K:QoBLMxmy2hfEbhrSS1bRorNKmVcl

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

urulyqqdpunjfhquxdy

Attributes
  • delay

    8

  • install

    true

  • install_file

    folders.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:1768
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB19.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:944
      • C:\Users\Admin\AppData\Roaming\folders.exe
        "C:\Users\Admin\AppData\Roaming\folders.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:912

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB19.tmp.bat
    Filesize

    150B

    MD5

    0f0adf75a327df084820e507d310467e

    SHA1

    f7459d10f280114443cdf387673ed4800b852227

    SHA256

    5d2bc81bd5020ba4e6512ad081393bbf2e516f5284c87291b766e57b0b5b654c

    SHA512

    9f5ec50a01e86c8d575c5824a813cc505a62a8d4ab3da55856dbf5eaa86f2bc3e31688ba0147697173fa6c174aa1252dc266b1322fa68411614267503ff8e261

  • C:\Users\Admin\AppData\Roaming\folders.exe
    Filesize

    72KB

    MD5

    04ffd19d0f37dbfb88183ed3a2be3e16

    SHA1

    55fc97fab3e9bb8028d0f488bfce17b9516c503f

    SHA256

    90636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6

    SHA512

    c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4

  • C:\Users\Admin\AppData\Roaming\folders.exe
    Filesize

    72KB

    MD5

    04ffd19d0f37dbfb88183ed3a2be3e16

    SHA1

    55fc97fab3e9bb8028d0f488bfce17b9516c503f

    SHA256

    90636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6

    SHA512

    c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4

  • memory/912-60-0x0000000000000000-mapping.dmp
  • memory/912-63-0x0000000000FB0000-0x0000000000FC2000-memory.dmp
    Filesize

    72KB

  • memory/944-59-0x0000000000000000-mapping.dmp
  • memory/1768-56-0x0000000000000000-mapping.dmp
  • memory/1780-55-0x0000000000000000-mapping.dmp
  • memory/1976-54-0x0000000000060000-0x0000000000072000-memory.dmp
    Filesize

    72KB

  • memory/2016-57-0x0000000000000000-mapping.dmp