Overview
overview
10Static
static
32bc78e0d14...2d.exe
windows7-x64
102bc78e0d14...2d.exe
windows10-2004-x64
104922d2660f...c5.exe
windows7-x64
104922d2660f...c5.exe
windows10-2004-x64
14e14f58935...61.exe
windows7-x64
104e14f58935...61.exe
windows10-2004-x64
164b9d76ec0...52.exe
windows7-x64
1064b9d76ec0...52.exe
windows10-2004-x64
379f68c9a2d...ee.exe
windows7-x64
779f68c9a2d...ee.exe
windows10-2004-x64
7c984a9446b...d3.exe
windows7-x64
10c984a9446b...d3.exe
windows10-2004-x64
3d69dc8e0a1...67.exe
windows7-x64
10d69dc8e0a1...67.exe
windows10-2004-x64
10dff2cf2793...3f.exe
windows7-x64
10dff2cf2793...3f.exe
windows10-2004-x64
1e542080348...18.exe
windows7-x64
10e542080348...18.exe
windows10-2004-x64
10f96c9a2487...e6.exe
windows7-x64
10f96c9a2487...e6.exe
windows10-2004-x64
3fe2da521d1...ff.exe
windows7-x64
10fe2da521d1...ff.exe
windows10-2004-x64
1Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16-06-2023 15:11
Behavioral task
behavioral1
Sample
2bc78e0d14294e35e680b1a6d530adb0cdd04090e1f2bda2f7a4571b8265162d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2bc78e0d14294e35e680b1a6d530adb0cdd04090e1f2bda2f7a4571b8265162d.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
4922d2660f30b4a1729b6861093b491a60ab49586545106b24af2840aa690ac5.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
4922d2660f30b4a1729b6861093b491a60ab49586545106b24af2840aa690ac5.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
4e14f58935961de4c602799826fe779776890a35ab1472ef4501377bfc413361.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
4e14f58935961de4c602799826fe779776890a35ab1472ef4501377bfc413361.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
64b9d76ec0d30f2875691f8b230e5caf8cddfa50ba1a763d59680473b2be0a52.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
64b9d76ec0d30f2875691f8b230e5caf8cddfa50ba1a763d59680473b2be0a52.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
79f68c9a2d1fdd27465c2cc6e2e90da2e2a6d90a5346ab5b109b64fb7457b6ee.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
79f68c9a2d1fdd27465c2cc6e2e90da2e2a6d90a5346ab5b109b64fb7457b6ee.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
d69dc8e0a175d54082c6f8650294e8a243536ca6183f4f62050f8bc017d05f67.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
d69dc8e0a175d54082c6f8650294e8a243536ca6183f4f62050f8bc017d05f67.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
e5420803485f33ca53c3314eb2a77370bf936083e5d32e1e0a53427731aed418.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
e5420803485f33ca53c3314eb2a77370bf936083e5d32e1e0a53427731aed418.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
fe2da521d1ffb45f669a038f6c729378978c3c144e4008bdcd70cf4edc2c1bff.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
fe2da521d1ffb45f669a038f6c729378978c3c144e4008bdcd70cf4edc2c1bff.exe
Resource
win10v2004-20230220-en
General
-
Target
c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3.exe
-
Size
1.4MB
-
MD5
8067edb9924b716bced6e360c04db039
-
SHA1
1ca8125a7c53eef1a31b99115e636352d24a117c
-
SHA256
c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3
-
SHA512
714890014c3619f5bd2d14561600a63c48a554adcf23953ffbee25cae0d35d25b439b75176b8b26521f8143e8342d16e31d02ed7f9192848c26b09a935a4d58c
-
SSDEEP
12288:GtvjAl4blss8+o4BIHAiKw7d4C+TSD0fzlj7iXhASBijMoryJKnS2IingFd0xYee:avjAl2lss82GIfzljHSIYG8bFT
Malware Config
Extracted
asyncrat
1.0.7
Default
aa9064aa.e1.luyouxia.net:22391
1
-
delay
1
-
install
false
-
install_file
1.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral11/memory/1396-54-0x0000000000380000-0x0000000000392000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3.exedescription pid process Token: SeDebugPrivilege 1396 c984a9446b24e7a75a7b034c5074e483fce1cace1591119c1a462d0cb2d509d3.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\Local\Temp\Tar4072.tmpFilesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
memory/1396-54-0x0000000000380000-0x0000000000392000-memory.dmpFilesize
72KB
-
memory/1396-55-0x0000000000220000-0x0000000000321000-memory.dmpFilesize
1.0MB
-
memory/1396-56-0x000000001A7F0000-0x000000001A870000-memory.dmpFilesize
512KB
-
memory/1396-57-0x000000001A7F0000-0x000000001A870000-memory.dmpFilesize
512KB
-
memory/1396-58-0x000000001A7F0000-0x000000001A870000-memory.dmpFilesize
512KB
-
memory/1396-96-0x000000001A7F0000-0x000000001A870000-memory.dmpFilesize
512KB
-
memory/1396-97-0x000000001A7F0000-0x000000001A870000-memory.dmpFilesize
512KB