Analysis
-
max time kernel
45s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 01:08
Behavioral task
behavioral1
Sample
bH8p.exe
Resource
win7-20220901-en
4 signatures
150 seconds
General
-
Target
bH8p.exe
-
Size
45KB
-
MD5
c78feb68e841eefc532eb5d3993ccf9c
-
SHA1
914616b3da61d38fab47e9213d08bd628175d4c9
-
SHA256
ab9a4d30723683772c778b0433641695624616d7c96e09948e8beb3d58f48818
-
SHA512
98c637cf0b4badb9d8700453ffc0e9587fa73495e27c3e5b2a5f07aaf464247cc958c1828e8f4e72b4a8b41f82876ed7c71178650d3f17d8d5398c5c33ffe4b5
-
SSDEEP
768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3itIpWnX9BDGm6NDs1BDZSx:vuwCfTgp/2OKYDy3bCXSa2X9BDGm6sdQ
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
146.190.69.247:6606
146.190.69.247:7707
146.190.69.247:8808
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-54-0x0000000000E50000-0x0000000000E62000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bH8p.exedescription pid process Token: SeDebugPrivilege 1340 bH8p.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-54-0x0000000000E50000-0x0000000000E62000-memory.dmpFilesize
72KB
-
memory/1340-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1340-56-0x00000000052B0000-0x000000000532E000-memory.dmpFilesize
504KB
-
memory/1340-57-0x00000000006F0000-0x00000000006FA000-memory.dmpFilesize
40KB
-
memory/1340-58-0x00000000057B0000-0x0000000005840000-memory.dmpFilesize
576KB
-
memory/1340-59-0x0000000002390000-0x00000000023F0000-memory.dmpFilesize
384KB