Analysis
-
max time kernel
41s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-10-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
c59d7f337636c78922afc92241bca86e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c59d7f337636c78922afc92241bca86e.exe
Resource
win10v2004-20220812-en
General
-
Target
c59d7f337636c78922afc92241bca86e.exe
-
Size
1.3MB
-
MD5
c59d7f337636c78922afc92241bca86e
-
SHA1
2712b3245ff84f49e72dde931f71d54a05539770
-
SHA256
cae2fb48c8bf03017b0d8321e79b3ac3209887eb77658e617c63f63a6f14f181
-
SHA512
7526e6f6a6acc7b8baa16fec29e8c7ba05b5b1049f2951ef44489251b00e2c969e92d9c42c9b5be3ce273f6a42feebcba8605bcff068b7309e79b6801d5f57a7
-
SSDEEP
12288:yrnjoa5ynWZQzjFeM6DJOjB9sTTHyzhYxwEf4N1gd2vnjc+Wk7pY9gfEqCO:VnYQb6VOp6wYQFEw
Malware Config
Extracted
asyncrat
1.0.7
Default
carlosmenguallora09.duckdns.org:1994
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1800-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1800-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1800-67-0x000000000040CBBE-mapping.dmp asyncrat behavioral1/memory/1800-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1800-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c59d7f337636c78922afc92241bca86e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xvkclzqcdjb\\chrome.exe\"" c59d7f337636c78922afc92241bca86e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c59d7f337636c78922afc92241bca86e.exedescription pid process target process PID 1636 set thread context of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2028 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exec59d7f337636c78922afc92241bca86e.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 1636 c59d7f337636c78922afc92241bca86e.exe Token: SeDebugPrivilege 1800 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c59d7f337636c78922afc92241bca86e.exedescription pid process target process PID 1636 wrote to memory of 2028 1636 c59d7f337636c78922afc92241bca86e.exe powershell.exe PID 1636 wrote to memory of 2028 1636 c59d7f337636c78922afc92241bca86e.exe powershell.exe PID 1636 wrote to memory of 2028 1636 c59d7f337636c78922afc92241bca86e.exe powershell.exe PID 1636 wrote to memory of 2028 1636 c59d7f337636c78922afc92241bca86e.exe powershell.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe PID 1636 wrote to memory of 1800 1636 c59d7f337636c78922afc92241bca86e.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c59d7f337636c78922afc92241bca86e.exe"C:\Users\Admin\AppData\Local\Temp\c59d7f337636c78922afc92241bca86e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-55-0x00000000005B0000-0x0000000000656000-memory.dmpFilesize
664KB
-
memory/1636-56-0x0000000004940000-0x00000000049D2000-memory.dmpFilesize
584KB
-
memory/1636-54-0x0000000000D90000-0x0000000000EE2000-memory.dmpFilesize
1.3MB
-
memory/1800-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-67-0x000000000040CBBE-mapping.dmp
-
memory/1800-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1800-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2028-57-0x0000000000000000-mapping.dmp
-
memory/2028-60-0x000000006F4C0000-0x000000006FA6B000-memory.dmpFilesize
5.7MB
-
memory/2028-59-0x000000006F4C0000-0x000000006FA6B000-memory.dmpFilesize
5.7MB
-
memory/2028-58-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB