Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 20:02
Behavioral task
behavioral1
Sample
028fe87e5497f4e26bbe39c176471fff.exe
Resource
win7v20210408
General
-
Target
028fe87e5497f4e26bbe39c176471fff.exe
-
Size
47KB
-
MD5
028fe87e5497f4e26bbe39c176471fff
-
SHA1
8fca7c8fe892025a88877b4a792c818c1b1577b6
-
SHA256
0c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
-
SHA512
c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
Malware Config
Extracted
asyncrat
0.5.7B
null:null
Mutex_6SI8OkPnk
-
aes_key
DscMhyDczTKORwloBJ1epU7bQBuEDRpB
-
anti_detection
false
-
autorun
true
-
bdos
true
-
delay
Default
-
host
null
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
Mutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/ZPLzEGMr
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat C:\Users\Admin\AppData\Roaming\svchost.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3452 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2236 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.exepid process 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe 636 028fe87e5497f4e26bbe39c176471fff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.exesvchost.exedescription pid process Token: SeDebugPrivilege 636 028fe87e5497f4e26bbe39c176471fff.exe Token: SeDebugPrivilege 3452 svchost.exe Token: SeDebugPrivilege 3452 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
028fe87e5497f4e26bbe39c176471fff.execmd.execmd.exedescription pid process target process PID 636 wrote to memory of 1448 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 636 wrote to memory of 1448 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 636 wrote to memory of 1448 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 636 wrote to memory of 3460 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 636 wrote to memory of 3460 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 636 wrote to memory of 3460 636 028fe87e5497f4e26bbe39c176471fff.exe cmd.exe PID 1448 wrote to memory of 2080 1448 cmd.exe schtasks.exe PID 1448 wrote to memory of 2080 1448 cmd.exe schtasks.exe PID 1448 wrote to memory of 2080 1448 cmd.exe schtasks.exe PID 3460 wrote to memory of 2236 3460 cmd.exe timeout.exe PID 3460 wrote to memory of 2236 3460 cmd.exe timeout.exe PID 3460 wrote to memory of 2236 3460 cmd.exe timeout.exe PID 3460 wrote to memory of 3452 3460 cmd.exe svchost.exe PID 3460 wrote to memory of 3452 3460 cmd.exe svchost.exe PID 3460 wrote to memory of 3452 3460 cmd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028fe87e5497f4e26bbe39c176471fff.exe"C:\Users\Admin\AppData\Local\Temp\028fe87e5497f4e26bbe39c176471fff.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B2C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9B2C.tmp.batMD5
bfdebdd9a212a68544dd107edd589334
SHA1c0a515e25c53feeda038f8dabf2ed15c44f99758
SHA25615d7e68d9426e972d535211375d06f49128cd466943ac7db3527af0c384e6ead
SHA512d044676846939c948aa148c3cf5aa4d5b4f75ef1d1846377ebd56b15ca8e261e31952bdf7b62a25d5ee465f2f1d0977aa40e8e1c478bbe93748eea1ab54810aa
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
028fe87e5497f4e26bbe39c176471fff
SHA18fca7c8fe892025a88877b4a792c818c1b1577b6
SHA2560c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
SHA512c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
028fe87e5497f4e26bbe39c176471fff
SHA18fca7c8fe892025a88877b4a792c818c1b1577b6
SHA2560c7e0d137c2972c95d20984a8f7501fc325f5170c041f90b953aba99b05dc3f2
SHA512c275270e803bd39e704568026f0777dc501b7728a0994ae1fcb7a6a9db87b2c30bf584d3cec317a5a4d597f9d19760591cfda5dbd4783a603b436a1b5b59e100
-
memory/636-116-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/636-117-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/636-114-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/1448-118-0x0000000000000000-mapping.dmp
-
memory/2080-121-0x0000000000000000-mapping.dmp
-
memory/2236-122-0x0000000000000000-mapping.dmp
-
memory/3452-123-0x0000000000000000-mapping.dmp
-
memory/3452-128-0x0000000005601000-0x0000000005602000-memory.dmpFilesize
4KB
-
memory/3452-130-0x0000000006800000-0x0000000006801000-memory.dmpFilesize
4KB
-
memory/3452-131-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/3460-119-0x0000000000000000-mapping.dmp