Analysis
-
max time kernel
31s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-05-2021 20:02
Behavioral task
behavioral1
Sample
028fe87e5497f4e26bbe39c176471fff.exe
Resource
win7v20210408
General
-
Target
028fe87e5497f4e26bbe39c176471fff.exe
-
Size
47KB
-
MD5
028fe87e5497f4e26bbe39c176471fff
-
SHA1
8fca7c8fe892025a88877b4a792c818c1b1577b6
-
SHA256
0c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
-
SHA512
c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
Malware Config
Extracted
asyncrat
0.5.7B
null:null
Mutex_6SI8OkPnk
-
aes_key
DscMhyDczTKORwloBJ1epU7bQBuEDRpB
-
anti_detection
false
-
autorun
true
-
bdos
true
-
delay
Default
-
host
null
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
Mutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/ZPLzEGMr
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 684 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1672 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 664 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.exepid process 1612 028fe87e5497f4e26bbe39c176471fff.exe 1612 028fe87e5497f4e26bbe39c176471fff.exe 1612 028fe87e5497f4e26bbe39c176471fff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.exesvchost.exedescription pid process Token: SeDebugPrivilege 1612 028fe87e5497f4e26bbe39c176471fff.exe Token: SeDebugPrivilege 684 svchost.exe Token: SeDebugPrivilege 684 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.execmd.execmd.exedescription pid process target process PID 1612 wrote to memory of 1668 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1668 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1668 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1668 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1672 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1672 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1672 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1612 wrote to memory of 1672 1612 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1668 wrote to memory of 1664 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 1664 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 1664 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 1664 1668 cmd.exe schtasks.exe PID 1672 wrote to memory of 664 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 664 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 664 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 664 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 684 1672 cmd.exe svchost.exe PID 1672 wrote to memory of 684 1672 cmd.exe svchost.exe PID 1672 wrote to memory of 684 1672 cmd.exe svchost.exe PID 1672 wrote to memory of 684 1672 cmd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028fe87e5497f4e26bbe39c176471fff.exe"C:\Users\Admin\AppData\Local\Temp\028fe87e5497f4e26bbe39c176471fff.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7752.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7752.tmp.batMD5
5499482c9ea23d926cfbe05603dc924c
SHA17743eb641dee4fc194f5739663650e66e76de184
SHA25664b355965606f9ddfa51fcf6822a0f2d7c7669bc51eb754ae289e46691e9a4ab
SHA51294bf75848586263bf555d7c04383ead02643dc01ccceb91d28bbd78c6b86ca6cba62ca0053227f5cefd9e0854da76ce2d3bbe7600c1e4629bf98917cedaffa43
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
028fe87e5497f4e26bbe39c176471fff
SHA18fca7c8fe892025a88877b4a792c818c1b1577b6
SHA2560c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
SHA512c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
028fe87e5497f4e26bbe39c176471fff
SHA18fca7c8fe892025a88877b4a792c818c1b1577b6
SHA2560c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
SHA512c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
-
\Users\Admin\AppData\Roaming\svchost.exeMD5
028fe87e5497f4e26bbe39c176471fff
SHA18fca7c8fe892025a88877b4a792c818c1b1577b6
SHA2560c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
SHA512c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
-
memory/664-68-0x0000000000000000-mapping.dmp
-
memory/684-71-0x0000000000000000-mapping.dmp
-
memory/684-73-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/684-76-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/1612-63-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/1612-62-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1612-60-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1664-66-0x0000000000000000-mapping.dmp
-
memory/1668-64-0x0000000000000000-mapping.dmp
-
memory/1672-65-0x0000000000000000-mapping.dmp