Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21-07-2023 20:59
Behavioral task
behavioral1
Sample
aratnotamouse.exe
Resource
win7-20230712-en
General
-
Target
aratnotamouse.exe
-
Size
47KB
-
MD5
4cf4e246ae9989b51e64b0fc1c8ca7d9
-
SHA1
9f52c14c854fa3300f8d184add69310f779c5755
-
SHA256
a17c7a643a56452209e4693b977b84b0265efc2f522b068046868a3f832313be
-
SHA512
f7facedb94ef8420bafec8f78df9e50275923f1f95e66a1cc1bef733b103a41f4c7588d770b6a9a78bb7c34e429d66609573f6dc3b25f84129a390ac2420236f
-
SSDEEP
768:2uQ/ltTxQ58sWUyOC2mo2q8EUKbj4MiPPI1Ov8Xv0b0PlysRJqxinOoY10gkmBD0:2uQ/ltTxib24dp1A88b0hRJ8inO/1Uow
Malware Config
Extracted
asyncrat
0.5.7B
default
127.0.0.1:4824
127.0.0.1:13577
4040:4824
4040:13577
Discord Inc
-
delay
3
-
install
true
-
install_file
aratnotamouse.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/2972-54-0x0000000000880000-0x0000000000892000-memory.dmp asyncrat behavioral1/files/0x000a000000012029-67.dat asyncrat behavioral1/files/0x000a000000012029-68.dat asyncrat behavioral1/files/0x000a000000012029-69.dat asyncrat behavioral1/memory/1724-70-0x00000000008F0000-0x0000000000902000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1724 aratnotamouse.exe -
Loads dropped DLL 1 IoCs
pid Process 2576 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2860 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2944 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 aratnotamouse.exe 2972 aratnotamouse.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2972 aratnotamouse.exe Token: SeDebugPrivilege 1724 aratnotamouse.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2492 2972 aratnotamouse.exe 29 PID 2972 wrote to memory of 2492 2972 aratnotamouse.exe 29 PID 2972 wrote to memory of 2492 2972 aratnotamouse.exe 29 PID 2972 wrote to memory of 2492 2972 aratnotamouse.exe 29 PID 2972 wrote to memory of 2576 2972 aratnotamouse.exe 31 PID 2972 wrote to memory of 2576 2972 aratnotamouse.exe 31 PID 2972 wrote to memory of 2576 2972 aratnotamouse.exe 31 PID 2972 wrote to memory of 2576 2972 aratnotamouse.exe 31 PID 2492 wrote to memory of 2860 2492 cmd.exe 33 PID 2492 wrote to memory of 2860 2492 cmd.exe 33 PID 2492 wrote to memory of 2860 2492 cmd.exe 33 PID 2492 wrote to memory of 2860 2492 cmd.exe 33 PID 2576 wrote to memory of 2944 2576 cmd.exe 34 PID 2576 wrote to memory of 2944 2576 cmd.exe 34 PID 2576 wrote to memory of 2944 2576 cmd.exe 34 PID 2576 wrote to memory of 2944 2576 cmd.exe 34 PID 2576 wrote to memory of 1724 2576 cmd.exe 35 PID 2576 wrote to memory of 1724 2576 cmd.exe 35 PID 2576 wrote to memory of 1724 2576 cmd.exe 35 PID 2576 wrote to memory of 1724 2576 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\aratnotamouse.exe"C:\Users\Admin\AppData\Local\Temp\aratnotamouse.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "aratnotamouse" /tr '"C:\Users\Admin\AppData\Roaming\aratnotamouse.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "aratnotamouse" /tr '"C:\Users\Admin\AppData\Roaming\aratnotamouse.exe"'3⤵
- Creates scheduled task(s)
PID:2860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9702.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2944
-
-
C:\Users\Admin\AppData\Roaming\aratnotamouse.exe"C:\Users\Admin\AppData\Roaming\aratnotamouse.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5593760efbde4dd61db938ebc52801841
SHA16981918a2a6403de3e5f8d9b8dd13a0b0d005688
SHA256edf14af7bdd2c2a4dfc536db3cc5cb2d11c188689de1aa4be18e91937c73c529
SHA512e10dd72348b80a8362717592c36971257171b7a95e66bc6c314a76e79a6ea0bcc1968c5a996a087b11dabd4a5fbb610f2851a8da8d5ebcf83d2207497e7b837f
-
Filesize
157B
MD5593760efbde4dd61db938ebc52801841
SHA16981918a2a6403de3e5f8d9b8dd13a0b0d005688
SHA256edf14af7bdd2c2a4dfc536db3cc5cb2d11c188689de1aa4be18e91937c73c529
SHA512e10dd72348b80a8362717592c36971257171b7a95e66bc6c314a76e79a6ea0bcc1968c5a996a087b11dabd4a5fbb610f2851a8da8d5ebcf83d2207497e7b837f
-
Filesize
47KB
MD54cf4e246ae9989b51e64b0fc1c8ca7d9
SHA19f52c14c854fa3300f8d184add69310f779c5755
SHA256a17c7a643a56452209e4693b977b84b0265efc2f522b068046868a3f832313be
SHA512f7facedb94ef8420bafec8f78df9e50275923f1f95e66a1cc1bef733b103a41f4c7588d770b6a9a78bb7c34e429d66609573f6dc3b25f84129a390ac2420236f
-
Filesize
47KB
MD54cf4e246ae9989b51e64b0fc1c8ca7d9
SHA19f52c14c854fa3300f8d184add69310f779c5755
SHA256a17c7a643a56452209e4693b977b84b0265efc2f522b068046868a3f832313be
SHA512f7facedb94ef8420bafec8f78df9e50275923f1f95e66a1cc1bef733b103a41f4c7588d770b6a9a78bb7c34e429d66609573f6dc3b25f84129a390ac2420236f
-
Filesize
47KB
MD54cf4e246ae9989b51e64b0fc1c8ca7d9
SHA19f52c14c854fa3300f8d184add69310f779c5755
SHA256a17c7a643a56452209e4693b977b84b0265efc2f522b068046868a3f832313be
SHA512f7facedb94ef8420bafec8f78df9e50275923f1f95e66a1cc1bef733b103a41f4c7588d770b6a9a78bb7c34e429d66609573f6dc3b25f84129a390ac2420236f