Analysis
-
max time kernel
151s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-10-2022 04:31
Static task
static1
Behavioral task
behavioral1
Sample
4abb165af5ad51597cc16b28ef97eca5.exe
Resource
win7-20220812-en
General
-
Target
4abb165af5ad51597cc16b28ef97eca5.exe
-
Size
585KB
-
MD5
4abb165af5ad51597cc16b28ef97eca5
-
SHA1
23a84b004ceffa09452139bd58b21a9d73450850
-
SHA256
df95a91a118bfa7350b166825dce79c425b2b0e4bead92fc294bd2500d614bf3
-
SHA512
06257d9c6cb09209a964ecaec3fea40e4c12c9b0f0fb29fd87c4dbf7a8e4ba55f71848ca917bc5b2854c374797c71f4c65812064968e657e7f5e1b222fbd290e
-
SSDEEP
12288:139riVwf3iJ+HN3TFIja5R53bD5G/xXy0aiXiRsBivc+A57Fd1d93rdqz1D2YSTz:1Nriy/fTFIj9cVELd
Malware Config
Extracted
asyncrat
0.5.6A
dgorijan20785.hopto.org:6606
dgorijan20785.hopto.org:7707
dgorijan20785.hopto.org:8808
servtle28477
-
delay
5
-
install
false
-
install_file
wintskl.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-66-0x000000000040C3AE-mapping.dmp asyncrat behavioral1/memory/1716-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1716-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-84-0x0000000000400000-0x0000000000878000-memory.dmp xmrig behavioral1/memory/1684-85-0x0000000000400000-0x0000000000878000-memory.dmp xmrig -
Processes:
resource yara_rule behavioral1/memory/1684-75-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-77-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-79-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-81-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-83-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-84-0x0000000000400000-0x0000000000878000-memory.dmp upx behavioral1/memory/1684-85-0x0000000000400000-0x0000000000878000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4abb165af5ad51597cc16b28ef97eca5.exe4abb165af5ad51597cc16b28ef97eca5.exedescription pid process target process PID 1628 set thread context of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1716 set thread context of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4abb165af5ad51597cc16b28ef97eca5.exe4abb165af5ad51597cc16b28ef97eca5.exepid process 1628 4abb165af5ad51597cc16b28ef97eca5.exe 1628 4abb165af5ad51597cc16b28ef97eca5.exe 1716 4abb165af5ad51597cc16b28ef97eca5.exe 1716 4abb165af5ad51597cc16b28ef97eca5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4abb165af5ad51597cc16b28ef97eca5.exe4abb165af5ad51597cc16b28ef97eca5.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1628 4abb165af5ad51597cc16b28ef97eca5.exe Token: SeDebugPrivilege 1716 4abb165af5ad51597cc16b28ef97eca5.exe Token: SeLockMemoryPrivilege 1684 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4abb165af5ad51597cc16b28ef97eca5.exe4abb165af5ad51597cc16b28ef97eca5.exedescription pid process target process PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1628 wrote to memory of 1716 1628 4abb165af5ad51597cc16b28ef97eca5.exe 4abb165af5ad51597cc16b28ef97eca5.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe PID 1716 wrote to memory of 1684 1716 4abb165af5ad51597cc16b28ef97eca5.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4abb165af5ad51597cc16b28ef97eca5.exe"C:\Users\Admin\AppData\Local\Temp\4abb165af5ad51597cc16b28ef97eca5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4abb165af5ad51597cc16b28ef97eca5.exe"C:\Users\Admin\AppData\Local\Temp\4abb165af5ad51597cc16b28ef97eca5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe-B --donate-level=1 -t 1 -v 0 --cpu-priority=3 -a cn/r -k -o xmrpool.eu:7777 -u 47Gqjt3AcDifzKf1JhnaYYSqpV1FL5f9ujKK5NtpL4tDPi7ewWytGSCCZbfcBeYMiCN5xUAJP6P7aHBtEecZPDHRAzpGaBg -p x3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-54-0x0000000001060000-0x00000000010F8000-memory.dmpFilesize
608KB
-
memory/1628-55-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1628-56-0x0000000000990000-0x00000000009C0000-memory.dmpFilesize
192KB
-
memory/1628-57-0x00000000008E0000-0x00000000008F8000-memory.dmpFilesize
96KB
-
memory/1628-58-0x0000000000580000-0x000000000059A000-memory.dmpFilesize
104KB
-
memory/1628-59-0x0000000000560000-0x0000000000566000-memory.dmpFilesize
24KB
-
memory/1684-84-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-85-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-74-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-83-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-81-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-79-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-80-0x0000000000871D60-mapping.dmp
-
memory/1684-77-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1684-75-0x0000000000400000-0x0000000000878000-memory.dmpFilesize
4.5MB
-
memory/1716-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-73-0x0000000000690000-0x0000000000696000-memory.dmpFilesize
24KB
-
memory/1716-72-0x0000000000630000-0x0000000000656000-memory.dmpFilesize
152KB
-
memory/1716-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-66-0x000000000040C3AE-mapping.dmp
-
memory/1716-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1716-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB