Overview

overview

10

Static

static

SCAN_COP.scr

windows7-x64

10

SCAN_COP.scr

windows10-2004-x64

1

Analysis

  • max time kernel
    232s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2022 18:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SCAN_COP.scr

  • Size

    1.0MB

  • MD5

    c5da839b1c6505b50f9d18588bc29dcc

  • SHA1

    808bcb8114f6188448b06ef581965e6ee09d4562

  • SHA256

    af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe

  • SHA512

    03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d

  • SSDEEP

    12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV

Score
10/10
asyncratijefundsrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Ijefunds

C2

79.134.225.20:8808

Mutex

mmkawdairhcehilxluo

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 6 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SCAN_COP.scr
    "C:\Users\Admin\AppData\Local\Temp\SCAN_COP.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rahWQrxsGOiUO.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rahWQrxsGOiUO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BE9.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1788
    • C:\Users\Admin\AppData\Local\Temp\SCAN_COP.scr
      "C:\Users\Admin\AppData\Local\Temp\SCAN_COP.scr"
      2⤵
        PID:868

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3BE9.tmp
      Filesize

      1KB

      MD5

      b195cf5974e55fa36fe4cb057ca6df3d

      SHA1

      0052319d8b1c989d979a912b56da40058ebb921e

      SHA256

      179ad83c0f81b482a7a11aefeb4c83178f0a82f40713f7debc8aa6ee8f92e8ea

      SHA512

      d35e4550a1380e60e15c773bb85c887b1ea210ee8b2ab6f6621cf1bf60f8843fd34a67c915f5c422c4a06da7b5c853c89fe96d690fb7f02269fac3a4f59c2f71

      Download Submit
    • memory/868-64-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-74-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-72-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-70-0x000000000040C62E-mapping.dmp
      Download
    • memory/868-69-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-68-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-67-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/868-65-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/908-58-0x0000000004420000-0x000000000448E000-memory.dmp
      Filesize

      440KB

      Download
    • memory/908-63-0x0000000002210000-0x0000000002222000-memory.dmp
      Filesize

      72KB

      Download
    • memory/908-54-0x0000000000B60000-0x0000000000C66000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/908-57-0x00000000004D0000-0x00000000004DC000-memory.dmp
      Filesize

      48KB

      Download
    • memory/908-56-0x00000000004A0000-0x00000000004BA000-memory.dmp
      Filesize

      104KB

      Download
    • memory/908-55-0x00000000751A1000-0x00000000751A3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1708-59-0x0000000000000000-mapping.dmp
      Download
    • memory/1708-75-0x000000006E760000-0x000000006ED0B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1708-77-0x000000006E760000-0x000000006ED0B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1788-60-0x0000000000000000-mapping.dmp
      Download