Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
01-05-2021 11:02
Behavioral task
behavioral1
Sample
KGk7fkL6.exe
Resource
win7v20210408
General
-
Target
KGk7fkL6.exe
-
Size
45KB
-
MD5
6c3eefa15c5dcf8046a280f434363488
-
SHA1
ba5ddc35cf6c386e3353973669d02c9379077b08
-
SHA256
9e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c
-
SHA512
282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e
Malware Config
Extracted
asyncrat
0.5.7B
Tktlert.kro.kr:5000
dwadwad1aw98d1965gtf*h47eft65h14fte98h41rt6h1ft789h41rft9h
-
aes_key
kuTGboagNLBMaK5ftkoTGf5T7oZj2sRO
-
anti_detection
true
-
autorun
true
-
bdos
true
-
delay
Default
-
host
Tktlert.kro.kr
-
hwid
3
- install_file
-
install_folder
%Temp%
-
mutex
dwadwad1aw98d1965gtf*h47eft65h14fte98h41rt6h1ft789h41rft9h
-
pastebin_config
null
-
port
5000
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\z1z.exe asyncrat C:\Users\Admin\AppData\Local\Temp\z1z.exe asyncrat C:\Users\Admin\AppData\Local\Temp\z1z.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
z1z.exepid process 868 z1z.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1044 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1708 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
KGk7fkL6.exepid process 1840 KGk7fkL6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
KGk7fkL6.exez1z.exedescription pid process Token: SeDebugPrivilege 1840 KGk7fkL6.exe Token: SeDebugPrivilege 868 z1z.exe Token: SeDebugPrivilege 868 z1z.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
KGk7fkL6.execmd.execmd.exedescription pid process target process PID 1840 wrote to memory of 1504 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1504 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1504 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1504 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1044 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1044 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1044 1840 KGk7fkL6.exe cmd.exe PID 1840 wrote to memory of 1044 1840 KGk7fkL6.exe cmd.exe PID 1504 wrote to memory of 1696 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1696 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1696 1504 cmd.exe schtasks.exe PID 1504 wrote to memory of 1696 1504 cmd.exe schtasks.exe PID 1044 wrote to memory of 1708 1044 cmd.exe timeout.exe PID 1044 wrote to memory of 1708 1044 cmd.exe timeout.exe PID 1044 wrote to memory of 1708 1044 cmd.exe timeout.exe PID 1044 wrote to memory of 1708 1044 cmd.exe timeout.exe PID 1044 wrote to memory of 868 1044 cmd.exe z1z.exe PID 1044 wrote to memory of 868 1044 cmd.exe z1z.exe PID 1044 wrote to memory of 868 1044 cmd.exe z1z.exe PID 1044 wrote to memory of 868 1044 cmd.exe z1z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KGk7fkL6.exe"C:\Users\Admin\AppData\Local\Temp\KGk7fkL6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "z1z" /tr '"C:\Users\Admin\AppData\Local\Temp\z1z.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "z1z" /tr '"C:\Users\Admin\AppData\Local\Temp\z1z.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\z1z.exe"C:\Users\Admin\AppData\Local\Temp\z1z.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.batMD5
dddeed56fe92adf6eeed259b9dcd99b6
SHA1b4a985d5ec91beb7a55af4bc3dcfd27fd38b11d4
SHA256cc4cc8a4c908584fa8318b64d21145bb6249b802deb955ca331306a6fa395eab
SHA512fa6d0860b22ae6afff3174eed1fc6734c61d87e7fc693b382a104eb3781c14f45162bf93a0301436690b16a63c1e2397686d44bccd745a7e4d70546e5955f43b
-
C:\Users\Admin\AppData\Local\Temp\z1z.exeMD5
6c3eefa15c5dcf8046a280f434363488
SHA1ba5ddc35cf6c386e3353973669d02c9379077b08
SHA2569e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c
SHA512282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e
-
C:\Users\Admin\AppData\Local\Temp\z1z.exeMD5
6c3eefa15c5dcf8046a280f434363488
SHA1ba5ddc35cf6c386e3353973669d02c9379077b08
SHA2569e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c
SHA512282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e
-
\Users\Admin\AppData\Local\Temp\z1z.exeMD5
6c3eefa15c5dcf8046a280f434363488
SHA1ba5ddc35cf6c386e3353973669d02c9379077b08
SHA2569e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c
SHA512282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e
-
memory/868-70-0x0000000000000000-mapping.dmp
-
memory/868-72-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/868-75-0x0000000002120000-0x0000000002121000-memory.dmpFilesize
4KB
-
memory/1044-64-0x0000000000000000-mapping.dmp
-
memory/1504-63-0x0000000000000000-mapping.dmp
-
memory/1696-65-0x0000000000000000-mapping.dmp
-
memory/1708-67-0x0000000000000000-mapping.dmp
-
memory/1840-62-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1840-61-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1840-59-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB