Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-04-2021 03:33
Behavioral task
behavioral1
Sample
nJhfKDwP.exe
Resource
win7v20210410
General
-
Target
nJhfKDwP.exe
-
Size
52KB
-
MD5
4198b4aad34131326392f6ff004bdc3b
-
SHA1
343397a61c1cb5d96db6c382d0d100a71b7a5675
-
SHA256
95fbecb2d0b0aa0fa80e02732237fc9eb43fc9f8af1efff062435b44b57f1a03
-
SHA512
818bfce435a35ddb4d0441235aee77a371334c87c66e7cf261c494ff4feada5dc0c21faee15480aa43e6627f5941dacd32363d5010a2666830f6a21435616e95
Malware Config
Extracted
asyncrat
0.5.7B
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:4782
cademc.zapto.org:6606
cademc.zapto.org:7707
cademc.zapto.org:8808
cademc.zapto.org:4782
AsyncMutex_6SI8OkPnk
-
aes_key
ZhQQk94aHNZ5cX6T38xeg5GO1INH17ha
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
127.0.0.1,cademc.zapto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808,4782
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\JDKUpdater.exe asyncrat \Users\Admin\AppData\Roaming\JDKUpdater.exe asyncrat C:\Users\Admin\AppData\Roaming\JDKUpdater.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
JDKUpdater.exepid process 340 JDKUpdater.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 612 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1120 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
nJhfKDwP.exepid process 1104 nJhfKDwP.exe 1104 nJhfKDwP.exe 1104 nJhfKDwP.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
nJhfKDwP.exeJDKUpdater.exedescription pid process Token: SeDebugPrivilege 1104 nJhfKDwP.exe Token: SeDebugPrivilege 340 JDKUpdater.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
nJhfKDwP.execmd.execmd.exedescription pid process target process PID 1104 wrote to memory of 848 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 848 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 848 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 848 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 612 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 612 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 612 1104 nJhfKDwP.exe cmd.exe PID 1104 wrote to memory of 612 1104 nJhfKDwP.exe cmd.exe PID 848 wrote to memory of 268 848 cmd.exe schtasks.exe PID 848 wrote to memory of 268 848 cmd.exe schtasks.exe PID 848 wrote to memory of 268 848 cmd.exe schtasks.exe PID 848 wrote to memory of 268 848 cmd.exe schtasks.exe PID 612 wrote to memory of 1120 612 cmd.exe timeout.exe PID 612 wrote to memory of 1120 612 cmd.exe timeout.exe PID 612 wrote to memory of 1120 612 cmd.exe timeout.exe PID 612 wrote to memory of 1120 612 cmd.exe timeout.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe PID 612 wrote to memory of 340 612 cmd.exe JDKUpdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nJhfKDwP.exe"C:\Users\Admin\AppData\Local\Temp\nJhfKDwP.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "JDKUpdater" /tr '"C:\Users\Admin\AppData\Roaming\JDKUpdater.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "JDKUpdater" /tr '"C:\Users\Admin\AppData\Roaming\JDKUpdater.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2C10.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\JDKUpdater.exe"C:\Users\Admin\AppData\Roaming\JDKUpdater.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2C10.tmp.batMD5
b0f769adb4ede62536185d7eb916644a
SHA16cbe926a9367bfd2510bb3937fa838b2d21b8f6c
SHA2560fe7628e38e1c6f32a54856de68aef7f31734d127fd8eaf32ca3c6b18f6a3e39
SHA512e26221d18d9163b6e736a0eb528ea5bd28ba54975d8b4ba615ef2ac47e0d18fbf5a8732244988591de1d56f89afa2380161a899a6aaedffc8b78d6a66b3382f2
-
C:\Users\Admin\AppData\Roaming\JDKUpdater.exeMD5
4198b4aad34131326392f6ff004bdc3b
SHA1343397a61c1cb5d96db6c382d0d100a71b7a5675
SHA25695fbecb2d0b0aa0fa80e02732237fc9eb43fc9f8af1efff062435b44b57f1a03
SHA512818bfce435a35ddb4d0441235aee77a371334c87c66e7cf261c494ff4feada5dc0c21faee15480aa43e6627f5941dacd32363d5010a2666830f6a21435616e95
-
C:\Users\Admin\AppData\Roaming\JDKUpdater.exeMD5
4198b4aad34131326392f6ff004bdc3b
SHA1343397a61c1cb5d96db6c382d0d100a71b7a5675
SHA25695fbecb2d0b0aa0fa80e02732237fc9eb43fc9f8af1efff062435b44b57f1a03
SHA512818bfce435a35ddb4d0441235aee77a371334c87c66e7cf261c494ff4feada5dc0c21faee15480aa43e6627f5941dacd32363d5010a2666830f6a21435616e95
-
\Users\Admin\AppData\Roaming\JDKUpdater.exeMD5
4198b4aad34131326392f6ff004bdc3b
SHA1343397a61c1cb5d96db6c382d0d100a71b7a5675
SHA25695fbecb2d0b0aa0fa80e02732237fc9eb43fc9f8af1efff062435b44b57f1a03
SHA512818bfce435a35ddb4d0441235aee77a371334c87c66e7cf261c494ff4feada5dc0c21faee15480aa43e6627f5941dacd32363d5010a2666830f6a21435616e95
-
memory/268-66-0x0000000000000000-mapping.dmp
-
memory/340-71-0x0000000000000000-mapping.dmp
-
memory/340-73-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/340-76-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/612-65-0x0000000000000000-mapping.dmp
-
memory/848-64-0x0000000000000000-mapping.dmp
-
memory/1104-63-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/1104-60-0x00000000011C0000-0x00000000011C1000-memory.dmpFilesize
4KB
-
memory/1104-62-0x0000000076E11000-0x0000000076E13000-memory.dmpFilesize
8KB
-
memory/1120-68-0x0000000000000000-mapping.dmp