Overview

overview

10

Static

static

822c659a8a...19.exe

windows7-x64

10

822c659a8a...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 17:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

  • Size

    1.1MB

  • MD5

    fd0f12448b7ce4e82e014b64b2676e93

  • SHA1

    3b5891e13f7f63c25e88030ba78d3290934f8640

  • SHA256

    822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619

  • SHA512

    34d01684dcc7f91439ac333e5ee86a1ce1e724ad8f71eaf3b7c215cd32b595e1b6835a7ed077c8ac3f42fe7975d103d06afae5031f446442a7b748f68a214c51

  • SSDEEP

    12288:+fcAcrc5/VtuUogBwjWxEOR3LkAb8C1atShBs/yyaVtLhqG5lg1tArWUHW9keeU8:U

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

hgjvhnfgg.duckdns.org:8057

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
    "C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:3624
    • C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
      "C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe"
      2⤵
        PID:1644

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1644-137-0x0000000000000000-mapping.dmp
      Download
    • memory/1644-138-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/3624-135-0x0000000000000000-mapping.dmp
      Download
    • memory/4716-134-0x0000000000000000-mapping.dmp
      Download
    • memory/4964-132-0x00000000000E0000-0x00000000001F6000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/4964-133-0x0000000004B60000-0x0000000004BFC000-memory.dmp
      Filesize

      624KB

      Download
    • memory/4964-136-0x0000000005CD0000-0x0000000006274000-memory.dmp
      Filesize

      5.6MB

      Download