Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04963699.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
General
-
Target
04963699.exe
-
Size
255KB
-
MD5
cc54630cfed370da5d83b5c3d0ee9ec4
-
SHA1
d18ba6e2d8e877bc0bec89536087f49a4bf32921
-
SHA256
1270491bd3068a4159eee0ad8c8d6871cf0ba80cac9fd749a7e9d1c02f6f3653
-
SHA512
1b7a78bb5303e97cb74896d68d6094a050e8859a2b944840619ad3b589a4654d292363e3afce33a7fd2d1805ead532ba706951149a9742f5040f2252d17b695a
-
SSDEEP
3072:FRsjupfBVcoFDzbtu/c762soY8zyCy0A:MKxBVjF3bc/cpsoYSHA
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
iphy1.duckdns.org:8808
Mutex
AsyncMutex_6SI8OkPnkg
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3340-136-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
04963699.exedescription pid process target process PID 1028 set thread context of 3340 1028 04963699.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
04963699.exepid process 1028 04963699.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3340 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
04963699.execmd.exedescription pid process target process PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 3340 1028 04963699.exe vbc.exe PID 1028 wrote to memory of 736 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 736 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 736 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 1148 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 1148 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 1148 1028 04963699.exe cmd.exe PID 1148 wrote to memory of 3056 1148 cmd.exe schtasks.exe PID 1148 wrote to memory of 3056 1148 cmd.exe schtasks.exe PID 1148 wrote to memory of 3056 1148 cmd.exe schtasks.exe PID 1028 wrote to memory of 3472 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 3472 1028 04963699.exe cmd.exe PID 1028 wrote to memory of 3472 1028 04963699.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04963699.exe"C:\Users\Admin\AppData\Local\Temp\04963699.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\winpr01"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\04963699.exe" "C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-133-0x0000000000560000-0x00000000005A6000-memory.dmpFilesize
280KB
-
memory/1028-134-0x0000000005680000-0x0000000005C24000-memory.dmpFilesize
5.6MB
-
memory/1028-135-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/3340-136-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3340-138-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB
-
memory/3340-139-0x0000000002DF0000-0x0000000002E56000-memory.dmpFilesize
408KB
-
memory/3340-140-0x0000000005A10000-0x0000000005AAC000-memory.dmpFilesize
624KB
-
memory/3340-141-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB