Analysis
-
max time kernel
112s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 20:12
Static task
static1
Behavioral task
behavioral1
Sample
4661d321d22ead59aa1dcf7805b9680e.exe
Resource
win7-20220812-en
General
-
Target
4661d321d22ead59aa1dcf7805b9680e.exe
-
Size
156KB
-
MD5
4661d321d22ead59aa1dcf7805b9680e
-
SHA1
0e87ec191765cbb62e9103e4cebc754314002e7d
-
SHA256
4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
-
SHA512
33d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
SSDEEP
3072:O6HomkMh4smo4GvX9m7+VBe16y71T+w/2FbM44:3+obvtIZIy7Wl
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
xxxprofxxx.dnsdojo.com:5126
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1096-59-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat behavioral1/memory/1096-60-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat behavioral1/memory/1096-61-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat behavioral1/memory/1096-62-0x000000000040FDEE-mapping.dmp asyncrat behavioral1/memory/1096-64-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat behavioral1/memory/1096-66-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat behavioral1/memory/1356-83-0x000000000040FDEE-mapping.dmp asyncrat behavioral1/memory/1356-86-0x00000000000B0000-0x00000000000C4000-memory.dmp asyncrat behavioral1/memory/1356-90-0x00000000000B0000-0x00000000000C4000-memory.dmp asyncrat behavioral1/memory/1356-93-0x00000000000B0000-0x00000000000C4000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
EregData.exeEregData.exepid process 1388 EregData.exe 1356 EregData.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exeEregData.exedescription pid process target process PID 2040 set thread context of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 1388 set thread context of 1356 1388 EregData.exe EregData.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1764 schtasks.exe 1556 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exepid process 1096 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exedescription pid process Token: SeDebugPrivilege 1096 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exepid process 1096 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.execmd.exetaskeng.exeEregData.execmd.exedescription pid process target process PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1096 2040 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2040 wrote to memory of 1900 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1900 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1900 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1900 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1304 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1304 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1304 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 1304 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 436 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 436 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 436 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 2040 wrote to memory of 436 2040 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 1304 wrote to memory of 1764 1304 cmd.exe schtasks.exe PID 1304 wrote to memory of 1764 1304 cmd.exe schtasks.exe PID 1304 wrote to memory of 1764 1304 cmd.exe schtasks.exe PID 1304 wrote to memory of 1764 1304 cmd.exe schtasks.exe PID 1812 wrote to memory of 1388 1812 taskeng.exe EregData.exe PID 1812 wrote to memory of 1388 1812 taskeng.exe EregData.exe PID 1812 wrote to memory of 1388 1812 taskeng.exe EregData.exe PID 1812 wrote to memory of 1388 1812 taskeng.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 1356 1388 EregData.exe EregData.exe PID 1388 wrote to memory of 544 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 544 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 544 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 544 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 768 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 768 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 768 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 768 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 1948 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 1948 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 1948 1388 EregData.exe cmd.exe PID 1388 wrote to memory of 1948 1388 EregData.exe cmd.exe PID 768 wrote to memory of 1556 768 cmd.exe schtasks.exe PID 768 wrote to memory of 1556 768 cmd.exe schtasks.exe PID 768 wrote to memory of 1556 768 cmd.exe schtasks.exe PID 768 wrote to memory of 1556 768 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\EregData"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe" "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {8F8959BB-EBC9-4F6F-8D79-AE84A057DD75} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeC:\Users\Admin\AppData\Roaming\EregData\EregData.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\EregData"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe" "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
memory/436-69-0x0000000000000000-mapping.dmp
-
memory/544-94-0x0000000000000000-mapping.dmp
-
memory/768-95-0x0000000000000000-mapping.dmp
-
memory/1096-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1096-62-0x000000000040FDEE-mapping.dmp
-
memory/1304-68-0x0000000000000000-mapping.dmp
-
memory/1356-83-0x000000000040FDEE-mapping.dmp
-
memory/1356-93-0x00000000000B0000-0x00000000000C4000-memory.dmpFilesize
80KB
-
memory/1356-90-0x00000000000B0000-0x00000000000C4000-memory.dmpFilesize
80KB
-
memory/1356-86-0x00000000000B0000-0x00000000000C4000-memory.dmpFilesize
80KB
-
memory/1388-75-0x0000000000060000-0x000000000008E000-memory.dmpFilesize
184KB
-
memory/1388-73-0x0000000000000000-mapping.dmp
-
memory/1556-97-0x0000000000000000-mapping.dmp
-
memory/1764-70-0x0000000000000000-mapping.dmp
-
memory/1900-67-0x0000000000000000-mapping.dmp
-
memory/1948-96-0x0000000000000000-mapping.dmp
-
memory/2040-55-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/2040-54-0x00000000008B0000-0x00000000008DE000-memory.dmpFilesize
184KB