Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-02-2023 22:17

General

  • Target

    d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe

  • Size

    591KB

  • MD5

    401240d7a40901b74d85ac7620b83915

  • SHA1

    3f512a8ff2f7d143a14badbc6191c3b8e09d23f6

  • SHA256

    d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

  • SHA512

    996da140a45b98cfd0e8f803037296b1b73cb01793c6302784d2bd1ae6fb3a58b17f171e6eefd406b73637457031fb1363ff9c2f97ca6eaeb71a51c1bd0f5cd2

  • SSDEEP

    12288:Yr8m6f8WlGdAGUow9aR9IlzTmKa188LY1dPijURkY6z7ZIahRZ5GcrO:bIeG5IHgoiqjqZIS5GcrO

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

100.42.65.218:8080

100.42.65.218:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    winsyd.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe
    "C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LGlGutVnWHPDKx.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGlGutVnWHPDKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D2A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2620
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:4516
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:3392

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp9D2A.tmp
        Filesize

        1KB

        MD5

        f990112ea6daf337abf0a5cdb75a6687

        SHA1

        d557b630c1bfb1d160139a65827ab601711c581d

        SHA256

        f82c5718394aa7f822664306d30d4d8637477036db671451ccb5fd66e6e8432a

        SHA512

        50c9b9b2b99d2390644823035ef707a46141ade4a3344a0f815557aeff99c61a699375918f8dcf5dec0ff99d51dea92e005825f9aaee2ee27685af7a586ada3a

      • memory/2620-203-0x0000000000000000-mapping.dmp
      • memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-150-0x0000000000C30000-0x0000000000CC8000-memory.dmp
        Filesize

        608KB

      • memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-180-0x0000000005560000-0x0000000005578000-memory.dmp
        Filesize

        96KB

      • memory/2716-181-0x0000000005660000-0x00000000056F2000-memory.dmp
        Filesize

        584KB

      • memory/2716-182-0x0000000005900000-0x000000000599C000-memory.dmp
        Filesize

        624KB

      • memory/2716-183-0x0000000077A60000-0x0000000077BEE000-memory.dmp
        Filesize

        1.6MB

      • memory/2716-185-0x0000000005C80000-0x0000000005CEE000-memory.dmp
        Filesize

        440KB

      • memory/2716-186-0x00000000061F0000-0x00000000066EE000-memory.dmp
        Filesize

        5.0MB

      • memory/2716-188-0x0000000005D00000-0x0000000006050000-memory.dmp
        Filesize

        3.3MB

      • memory/2716-253-0x0000000006090000-0x00000000060A4000-memory.dmp
        Filesize

        80KB

      • memory/3392-258-0x000000000040C71E-mapping.dmp
      • memory/3392-315-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

      • memory/3512-200-0x0000000000000000-mapping.dmp
      • memory/3512-260-0x0000000006930000-0x0000000006966000-memory.dmp
        Filesize

        216KB

      • memory/3512-274-0x0000000006FA0000-0x00000000075C8000-memory.dmp
        Filesize

        6.2MB

      • memory/3512-320-0x0000000007750000-0x0000000007772000-memory.dmp
        Filesize

        136KB

      • memory/3512-321-0x0000000007950000-0x00000000079B6000-memory.dmp
        Filesize

        408KB

      • memory/3512-322-0x0000000007690000-0x00000000076F6000-memory.dmp
        Filesize

        408KB

      • memory/3512-323-0x0000000007A80000-0x0000000007DD0000-memory.dmp
        Filesize

        3.3MB

      • memory/3512-326-0x00000000078A0000-0x00000000078BC000-memory.dmp
        Filesize

        112KB

      • memory/3512-327-0x00000000082A0000-0x00000000082EB000-memory.dmp
        Filesize

        300KB

      • memory/3512-331-0x0000000008010000-0x0000000008086000-memory.dmp
        Filesize

        472KB

      • memory/3512-344-0x0000000009160000-0x0000000009193000-memory.dmp
        Filesize

        204KB

      • memory/3512-345-0x0000000009120000-0x000000000913E000-memory.dmp
        Filesize

        120KB

      • memory/3512-354-0x0000000009290000-0x0000000009335000-memory.dmp
        Filesize

        660KB

      • memory/3512-358-0x0000000009460000-0x00000000094F4000-memory.dmp
        Filesize

        592KB

      • memory/3512-578-0x0000000006C00000-0x0000000006C1A000-memory.dmp
        Filesize

        104KB

      • memory/3512-583-0x0000000006BF0000-0x0000000006BF8000-memory.dmp
        Filesize

        32KB