Analysis
-
max time kernel
117s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 20:46
Static task
static1
Behavioral task
behavioral1
Sample
SKM-210221.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SKM-210221.exe
Resource
win10-en-20211208
General
-
Target
SKM-210221.exe
-
Size
17KB
-
MD5
5da85385325f5290a7fae0141809a615
-
SHA1
0e8d69936b68f66f5cf795b3318b0c13d62c54ac
-
SHA256
a0255bd8a15446c39c4c32dceab9116c541583938022f13d3846012b9ee4c65f
-
SHA512
e76b802796a29de2600aa4e8f1fad73945a624d0d8289af9c20e3c1cd2f6b475b4fc99989e29c4b7f8da0652e36b61b3de4811fa9491fa4d89e633bab36d6cce
Malware Config
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-62-0x0000000000400000-0x000000000041A000-memory.dmp asyncrat behavioral1/memory/1544-63-0x0000000000400000-0x000000000041A000-memory.dmp asyncrat behavioral1/memory/1544-64-0x0000000000400000-0x000000000041A000-memory.dmp asyncrat behavioral1/memory/1544-65-0x0000000000400000-0x000000000041A000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SKM-210221.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Demo\\Chrome.exe\"" SKM-210221.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SKM-210221.exedescription pid process target process PID 1692 set thread context of 1544 1692 SKM-210221.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 472 timeout.exe 636 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
SKM-210221.exepid process 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe 1692 SKM-210221.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SKM-210221.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1692 SKM-210221.exe Token: SeDebugPrivilege 1544 MSBuild.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
SKM-210221.execmd.execmd.exedescription pid process target process PID 1692 wrote to memory of 1112 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1112 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1112 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1112 1692 SKM-210221.exe cmd.exe PID 1112 wrote to memory of 472 1112 cmd.exe timeout.exe PID 1112 wrote to memory of 472 1112 cmd.exe timeout.exe PID 1112 wrote to memory of 472 1112 cmd.exe timeout.exe PID 1112 wrote to memory of 472 1112 cmd.exe timeout.exe PID 1692 wrote to memory of 1352 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1352 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1352 1692 SKM-210221.exe cmd.exe PID 1692 wrote to memory of 1352 1692 SKM-210221.exe cmd.exe PID 1352 wrote to memory of 636 1352 cmd.exe timeout.exe PID 1352 wrote to memory of 636 1352 cmd.exe timeout.exe PID 1352 wrote to memory of 636 1352 cmd.exe timeout.exe PID 1352 wrote to memory of 636 1352 cmd.exe timeout.exe PID 1692 wrote to memory of 1144 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1144 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1144 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1144 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1164 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1164 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1164 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1164 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1804 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1804 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1804 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1804 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1048 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1048 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1048 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1048 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1628 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1628 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1628 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1628 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 968 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 968 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 968 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 968 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe PID 1692 wrote to memory of 1544 1692 SKM-210221.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM-210221.exe"C:\Users\Admin\AppData\Local\Temp\SKM-210221.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout 102⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout 102⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
170dd2268c32df235553da902504624e
SHA1eb90ee039bfda8c76b2b8e9b50625f79fa986757
SHA256816712d74618373bb1a952191c36c15cfc8c56860ebf66e540787dc98cd5ec0b
SHA512db821a1fd37bee78957033e2b00528c1b941a1d87bba01baf25704571e641aabce3ba5777aabdf914eb99282f1d65933b8b69835807904a33f0492b52f8873d0
-
memory/1544-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1544-65-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1544-69-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/1544-67-0x0000000002130000-0x0000000002131000-memory.dmpFilesize
4KB
-
memory/1544-64-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1544-61-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1544-62-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1544-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1692-54-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/1692-59-0x0000000005000000-0x000000000504C000-memory.dmpFilesize
304KB
-
memory/1692-56-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/1692-58-0x00000000040B0000-0x00000000040E4000-memory.dmpFilesize
208KB
-
memory/1692-55-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1692-57-0x0000000000610000-0x000000000065C000-memory.dmpFilesize
304KB