Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-es -
resource tags
-
submitted
05-10-2022 23:33
General
-
Target
APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe
-
Size
8MB
-
MD5
705385c167486ac75a5063f6934c5631
-
SHA1
d08da29cca536b6b502cec7ca2f5c9cb419308e2
-
SHA256
558af040bcfa1aaf774e953cca682eaaf38ec8c4f3ca4f3e24e0ea8a783ca1df
-
SHA512
67249411406d7a6f41a97a6e40facd364fb6777c2833465aacdc6081fde3854109c9a308f5dc6f03c6fd940cc2d291be7ce9b13c6dc5a45dc810d091e98d88af
-
SSDEEP
98304:7soxgg0Y8w5AUY52JgpVOEjrZGNw9J2/8w1MlpYRO1izoaRIS9NhICGucHATgwY0:p8Aohi8Y/+y
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
maraddiego763.duckdns.org:1881
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Windows security bypass 2 TTPs 3 IoCs
-
Async RAT payload 6 IoCs
-
Drops startup file 2 IoCs
-
Windows security modification 2 TTPs 9 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe"C:\Users\Admin\AppData\Local\Temp\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe"
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe" -Force
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe" -Force
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe" -Force
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe" -Force
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f9da165545a77d6b78c9a812a366675b
SHA1458e94d697990e042640a4d294aeb72fcc64fa6b
SHA256240d15262c790e38a9ebcc959c1ca25ee616d3d3ec33bd3f41f1d389d8323c20
SHA512138def5c9d38a3d78232809ec60d852bf8dc49ce6694c7ad340c53c596c467f1f9e980a7752d5bbd4de7470ef61f9840ea1b221bb2b7bf49175f3ab436fd0737
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f9da165545a77d6b78c9a812a366675b
SHA1458e94d697990e042640a4d294aeb72fcc64fa6b
SHA256240d15262c790e38a9ebcc959c1ca25ee616d3d3ec33bd3f41f1d389d8323c20
SHA512138def5c9d38a3d78232809ec60d852bf8dc49ce6694c7ad340c53c596c467f1f9e980a7752d5bbd4de7470ef61f9840ea1b221bb2b7bf49175f3ab436fd0737
-
memory/716-71-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/716-69-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/716-60-0x0000000000000000-mapping.dmp
-
memory/904-73-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/904-67-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/904-63-0x0000000000000000-mapping.dmp
-
memory/1016-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-85-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-81-0x000000000040C72E-mapping.dmp
-
memory/1016-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1300-55-0x0000000004BE0000-0x0000000004CDC000-memory.dmpFilesize
1008KB
-
memory/1300-54-0x0000000000A30000-0x0000000001316000-memory.dmpFilesize
8MB
-
memory/1300-56-0x0000000075A81000-0x0000000075A83000-memory.dmpFilesize
8KB
-
memory/1576-74-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/1576-59-0x0000000000000000-mapping.dmp
-
memory/1576-68-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/2028-72-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/2028-70-0x000000006F6E0000-0x000000006FC8B000-memory.dmpFilesize
5MB
-
memory/2028-57-0x0000000000000000-mapping.dmp