Analysis
-
max time kernel
79s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 17:47
Behavioral task
behavioral1
Sample
AsyncAplicativo.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AsyncAplicativo.exe
Resource
win10v2004-20221111-en
General
-
Target
AsyncAplicativo.exe
-
Size
47KB
-
MD5
711fbd6412e3030d4653a05883fcd498
-
SHA1
f1c2a454140c5e4df310643c6e5ee21e50373904
-
SHA256
53e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
-
SHA512
fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
SSDEEP
768:yuiHNTdFHLBWUZiGrmo2qrKkb6uKEKqPICRPCC7RB80byrwG+a1ZlgVrZiBDZUx:yuiHNTdBR2tkcTCRPznbyrh+a1U5ZcdW
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:8888
127.0.0.1:53370
flingmodder-53370.portmap.io:6606
flingmodder-53370.portmap.io:7707
flingmodder-53370.portmap.io:8808
flingmodder-53370.portmap.io:8888
flingmodder-53370.portmap.io:53370
Admin
-
delay
3
-
install
true
-
install_file
Windows.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1808-54-0x00000000001D0000-0x00000000001E2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\Windows.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows.exe asyncrat behavioral1/memory/1532-65-0x00000000011B0000-0x00000000011C2000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid process 1532 Windows.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 752 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1960 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncAplicativo.exepid process 1808 AsyncAplicativo.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AsyncAplicativo.exeWindows.exedescription pid process Token: SeDebugPrivilege 1808 AsyncAplicativo.exe Token: SeDebugPrivilege 1532 Windows.exe Token: SeDebugPrivilege 1532 Windows.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
AsyncAplicativo.execmd.execmd.exedescription pid process target process PID 1808 wrote to memory of 556 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 556 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 556 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 556 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 752 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 752 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 752 1808 AsyncAplicativo.exe cmd.exe PID 1808 wrote to memory of 752 1808 AsyncAplicativo.exe cmd.exe PID 556 wrote to memory of 1860 556 cmd.exe schtasks.exe PID 556 wrote to memory of 1860 556 cmd.exe schtasks.exe PID 556 wrote to memory of 1860 556 cmd.exe schtasks.exe PID 556 wrote to memory of 1860 556 cmd.exe schtasks.exe PID 752 wrote to memory of 1960 752 cmd.exe timeout.exe PID 752 wrote to memory of 1960 752 cmd.exe timeout.exe PID 752 wrote to memory of 1960 752 cmd.exe timeout.exe PID 752 wrote to memory of 1960 752 cmd.exe timeout.exe PID 752 wrote to memory of 1532 752 cmd.exe Windows.exe PID 752 wrote to memory of 1532 752 cmd.exe Windows.exe PID 752 wrote to memory of 1532 752 cmd.exe Windows.exe PID 752 wrote to memory of 1532 752 cmd.exe Windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncAplicativo.exe"C:\Users\Admin\AppData\Local\Temp\AsyncAplicativo.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4201.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows.exe"C:\Users\Admin\AppData\Roaming\Windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4201.tmp.batFilesize
151B
MD5f5674a71ad77d5b3b3023663719d2d5d
SHA14c71a1cdaf431bf2f80d355c27fcf7554d49a737
SHA256cceb51120234624908a6efabd8b0bde233304ccbae4c57727f86d8d9b62f7cb8
SHA512716cc6dc322749bb5b453400971a5dce7f1277a68352d40fb44bb2f4dcc6dee978512acef6ba75454876098e945270a5584542a5f523915b30ad45f063f8aa45
-
C:\Users\Admin\AppData\Roaming\Windows.exeFilesize
47KB
MD5711fbd6412e3030d4653a05883fcd498
SHA1f1c2a454140c5e4df310643c6e5ee21e50373904
SHA25653e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
SHA512fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
C:\Users\Admin\AppData\Roaming\Windows.exeFilesize
47KB
MD5711fbd6412e3030d4653a05883fcd498
SHA1f1c2a454140c5e4df310643c6e5ee21e50373904
SHA25653e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
SHA512fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
\Users\Admin\AppData\Roaming\Windows.exeFilesize
47KB
MD5711fbd6412e3030d4653a05883fcd498
SHA1f1c2a454140c5e4df310643c6e5ee21e50373904
SHA25653e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
SHA512fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
memory/556-56-0x0000000000000000-mapping.dmp
-
memory/752-57-0x0000000000000000-mapping.dmp
-
memory/1532-63-0x0000000000000000-mapping.dmp
-
memory/1532-65-0x00000000011B0000-0x00000000011C2000-memory.dmpFilesize
72KB
-
memory/1808-54-0x00000000001D0000-0x00000000001E2000-memory.dmpFilesize
72KB
-
memory/1808-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1860-58-0x0000000000000000-mapping.dmp
-
memory/1960-60-0x0000000000000000-mapping.dmp