Analysis
-
max time kernel
190s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 23:26
Static task
static1
Behavioral task
behavioral1
Sample
19590a0af1f36d0aa9e9f7515a5ee7b7.exe
Resource
win7-20221111-en
General
-
Target
19590a0af1f36d0aa9e9f7515a5ee7b7.exe
-
Size
1.1MB
-
MD5
19590a0af1f36d0aa9e9f7515a5ee7b7
-
SHA1
ba3812e84be2d9fe890b8398abdc26a3a1d05331
-
SHA256
e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d
-
SHA512
57d915c8608f07517951fe644abef0505eee8455c3d10d563798d835dde9617a2453d64cf8683e1cb9a720643859af1981dede17f1f91de122ed458ace582b16
-
SSDEEP
24576:Ob2aCoEYQ68QyzJdmDMbmMNIhfntXoYyLb2rARuG:No3Q0yzPmgb/IvYYWb2rAR
Malware Config
Extracted
asyncrat
0.5.7B
luxy2sdds
asnyc2020.ddns.net:2119
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
systme.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/852-59-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/852-60-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/852-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/852-62-0x000000000040C74E-mapping.dmp asyncrat behavioral1/memory/852-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/852-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/852-72-0x0000000000C40000-0x0000000000C66000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
19590a0af1f36d0aa9e9f7515a5ee7b7.exedescription pid process target process PID 632 set thread context of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 852 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
19590a0af1f36d0aa9e9f7515a5ee7b7.exedescription pid process target process PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe PID 632 wrote to memory of 852 632 19590a0af1f36d0aa9e9f7515a5ee7b7.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19590a0af1f36d0aa9e9f7515a5ee7b7.exe"C:\Users\Admin\AppData\Local\Temp\19590a0af1f36d0aa9e9f7515a5ee7b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-54-0x0000000000FF0000-0x000000000111A000-memory.dmpFilesize
1.2MB
-
memory/632-55-0x0000000000970000-0x0000000000A02000-memory.dmpFilesize
584KB
-
memory/852-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-62-0x000000000040C74E-mapping.dmp
-
memory/852-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/852-67-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/852-68-0x0000000006440000-0x00000000064BE000-memory.dmpFilesize
504KB
-
memory/852-69-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/852-70-0x0000000006560000-0x00000000065F0000-memory.dmpFilesize
576KB
-
memory/852-71-0x0000000005050000-0x00000000050B0000-memory.dmpFilesize
384KB
-
memory/852-72-0x0000000000C40000-0x0000000000C66000-memory.dmpFilesize
152KB