Analysis
-
max time kernel
161s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 20:12
Static task
static1
Behavioral task
behavioral1
Sample
4661d321d22ead59aa1dcf7805b9680e.exe
Resource
win7-20220812-en
General
-
Target
4661d321d22ead59aa1dcf7805b9680e.exe
-
Size
156KB
-
MD5
4661d321d22ead59aa1dcf7805b9680e
-
SHA1
0e87ec191765cbb62e9103e4cebc754314002e7d
-
SHA256
4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
-
SHA512
33d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
SSDEEP
3072:O6HomkMh4smo4GvX9m7+VBe16y71T+w/2FbM44:3+obvtIZIy7Wl
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
xxxprofxxx.dnsdojo.com:5126
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4948-137-0x0000000000410000-0x0000000000424000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
EregData.exeEregData.exepid process 2172 EregData.exe 1368 EregData.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exeEregData.exedescription pid process target process PID 5072 set thread context of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 2172 set thread context of 1368 2172 EregData.exe EregData.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2212 schtasks.exe 1312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exepid process 4948 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exedescription pid process Token: SeDebugPrivilege 4948 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.exepid process 4948 4661d321d22ead59aa1dcf7805b9680e.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
4661d321d22ead59aa1dcf7805b9680e.execmd.exeEregData.execmd.exedescription pid process target process PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4948 5072 4661d321d22ead59aa1dcf7805b9680e.exe 4661d321d22ead59aa1dcf7805b9680e.exe PID 5072 wrote to memory of 4060 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 4060 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 4060 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 3080 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 3080 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 3080 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 4820 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 4820 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 5072 wrote to memory of 4820 5072 4661d321d22ead59aa1dcf7805b9680e.exe cmd.exe PID 3080 wrote to memory of 2212 3080 cmd.exe schtasks.exe PID 3080 wrote to memory of 2212 3080 cmd.exe schtasks.exe PID 3080 wrote to memory of 2212 3080 cmd.exe schtasks.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1368 2172 EregData.exe EregData.exe PID 2172 wrote to memory of 1248 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 1248 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 1248 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4768 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4768 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4768 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4760 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4760 2172 EregData.exe cmd.exe PID 2172 wrote to memory of 4760 2172 EregData.exe cmd.exe PID 4768 wrote to memory of 1312 4768 cmd.exe schtasks.exe PID 4768 wrote to memory of 1312 4768 cmd.exe schtasks.exe PID 4768 wrote to memory of 1312 4768 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\EregData"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\4661d321d22ead59aa1dcf7805b9680e.exe" "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeC:\Users\Admin\AppData\Roaming\EregData\EregData.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\EregData"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\EregData\EregData.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe" "C:\Users\Admin\AppData\Roaming\EregData\EregData.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EregData.exe.logFilesize
612B
MD54bc94363628f46b343c5e8e2da62ca26
SHA18a41ac46e24d790e11a407d0e957c4a6be6056c4
SHA256c8e1d0b306825b2c9a3ed32a461dd191ceb861205425fdfb687a4889684a3e1a
SHA512cf8ede5b84ba775d8ff89752530fa899d6b2e6424549202ab782a3caa92c0d9a31e9b2f660b51eedc932a68ba25e9ec228bb965cdc183e600ea8aa5a6736f829
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
C:\Users\Admin\AppData\Roaming\EregData\EregData.exeFilesize
156KB
MD54661d321d22ead59aa1dcf7805b9680e
SHA10e87ec191765cbb62e9103e4cebc754314002e7d
SHA2564ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA51233d35b16524a010dbb08155708a9a6ed217d677ad4121e84131a1e1c59cd5fc0baa1f9dc1289bcc57e63be7dbc271d82008080a9acc8a30ba9fee10a4f511832
-
memory/1248-150-0x0000000000000000-mapping.dmp
-
memory/1312-153-0x0000000000000000-mapping.dmp
-
memory/1368-147-0x0000000000000000-mapping.dmp
-
memory/2212-141-0x0000000000000000-mapping.dmp
-
memory/3080-139-0x0000000000000000-mapping.dmp
-
memory/4060-138-0x0000000000000000-mapping.dmp
-
memory/4760-152-0x0000000000000000-mapping.dmp
-
memory/4768-151-0x0000000000000000-mapping.dmp
-
memory/4820-140-0x0000000000000000-mapping.dmp
-
memory/4948-143-0x0000000004F90000-0x0000000004F9A000-memory.dmpFilesize
40KB
-
memory/4948-144-0x0000000005A40000-0x0000000005ADC000-memory.dmpFilesize
624KB
-
memory/4948-142-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/4948-137-0x0000000000410000-0x0000000000424000-memory.dmpFilesize
80KB
-
memory/4948-135-0x0000000000000000-mapping.dmp
-
memory/5072-132-0x0000000000430000-0x000000000045E000-memory.dmpFilesize
184KB
-
memory/5072-134-0x0000000004DC0000-0x0000000004E26000-memory.dmpFilesize
408KB
-
memory/5072-133-0x00000000052A0000-0x0000000005844000-memory.dmpFilesize
5.6MB