Analysis
-
max time kernel
81s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 01:24
Static task
static1
Behavioral task
behavioral1
Sample
gpiQaD7JJyHJILw.exe
Resource
win7-20230220-en
General
-
Target
gpiQaD7JJyHJILw.exe
-
Size
629KB
-
MD5
9ffc9a9e7bbfa15fa3fb73631d4ed9ef
-
SHA1
247c625f835a1e8a98fe40dbfbc72546d45cb205
-
SHA256
70eaca68c13178818bb56a31bfc2ce4395a14e198a78cc1caf991480e19ea939
-
SHA512
0fb6ca18528f7478e48d37c4a538764a046380495b9d8218b3f44a792f074f8139df41194a7f7653ab87cef70f910854f14618d187ce237fc936b716eae391a7
-
SSDEEP
12288:HKZ2B0xTGlxNqvNu2hZ+nUEsn96fTxkeRAPP1Xe2hIM/h6Nw/YPBwANFHcsy:HiLaVUH9990TxLK8M/8K4hN5jy
Malware Config
Extracted
asyncrat
0.5.7B
Default
95.214.27.44:6606
95.214.27.44:7707
95.214.27.44:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/540-140-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gpiQaD7JJyHJILw.exedescription pid process target process PID 5000 set thread context of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
gpiQaD7JJyHJILw.exepid process 5000 gpiQaD7JJyHJILw.exe 5000 gpiQaD7JJyHJILw.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
gpiQaD7JJyHJILw.exegpiQaD7JJyHJILw.exedescription pid process Token: SeDebugPrivilege 5000 gpiQaD7JJyHJILw.exe Token: SeDebugPrivilege 540 gpiQaD7JJyHJILw.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
gpiQaD7JJyHJILw.exedescription pid process target process PID 5000 wrote to memory of 4496 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 4496 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 4496 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe PID 5000 wrote to memory of 540 5000 gpiQaD7JJyHJILw.exe gpiQaD7JJyHJILw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"C:\Users\Admin\AppData\Local\Temp\gpiQaD7JJyHJILw.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gpiQaD7JJyHJILw.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/540-140-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/540-143-0x0000000005180000-0x0000000005190000-memory.dmpFilesize
64KB
-
memory/540-144-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/540-145-0x0000000005180000-0x0000000005190000-memory.dmpFilesize
64KB
-
memory/5000-133-0x0000000000540000-0x00000000005E4000-memory.dmpFilesize
656KB
-
memory/5000-134-0x0000000005680000-0x0000000005C24000-memory.dmpFilesize
5.6MB
-
memory/5000-135-0x0000000004FB0000-0x0000000005042000-memory.dmpFilesize
584KB
-
memory/5000-136-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/5000-137-0x0000000004FA0000-0x0000000004FAA000-memory.dmpFilesize
40KB
-
memory/5000-138-0x00000000052D0000-0x000000000536C000-memory.dmpFilesize
624KB
-
memory/5000-139-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB