Analysis
-
max time kernel
117s -
max time network
157s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 08:36
Static task
static1
Behavioral task
behavioral1
Sample
Faktura ref. # IRQ-21-07778.exe
Resource
win7-en-20211208
General
-
Target
Faktura ref. # IRQ-21-07778.exe
-
Size
697KB
-
MD5
d2c4ad3484a598f0848a7947fc45175f
-
SHA1
2c7807352b5ece76d1e0364acdcfce3bc2cd9b72
-
SHA256
1b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
-
SHA512
366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
Malware Config
Extracted
asyncrat
0.5.7B
Default
89.238.150.43:57095
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
true
-
install_file
chromeex.exe
-
install_folder
%Temp%
-
pastebin_config
null
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/392-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/392-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/392-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/392-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
chromeex.exechromeex.exepid process 968 chromeex.exe 956 chromeex.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exechromeex.exepid process 608 cmd.exe 968 chromeex.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Faktura ref. # IRQ-21-07778.exechromeex.exedescription pid process target process PID 1624 set thread context of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 968 set thread context of 956 968 chromeex.exe chromeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1272 schtasks.exe 988 schtasks.exe 1592 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1608 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeFaktura ref. # IRQ-21-07778.exepowershell.exepid process 568 powershell.exe 392 Faktura ref. # IRQ-21-07778.exe 392 Faktura ref. # IRQ-21-07778.exe 392 Faktura ref. # IRQ-21-07778.exe 1728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeFaktura ref. # IRQ-21-07778.exepowershell.exechromeex.exedescription pid process Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 392 Faktura ref. # IRQ-21-07778.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeDebugPrivilege 956 chromeex.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
Faktura ref. # IRQ-21-07778.exeFaktura ref. # IRQ-21-07778.execmd.execmd.exechromeex.exedescription pid process target process PID 1624 wrote to memory of 568 1624 Faktura ref. # IRQ-21-07778.exe powershell.exe PID 1624 wrote to memory of 568 1624 Faktura ref. # IRQ-21-07778.exe powershell.exe PID 1624 wrote to memory of 568 1624 Faktura ref. # IRQ-21-07778.exe powershell.exe PID 1624 wrote to memory of 568 1624 Faktura ref. # IRQ-21-07778.exe powershell.exe PID 1624 wrote to memory of 1272 1624 Faktura ref. # IRQ-21-07778.exe schtasks.exe PID 1624 wrote to memory of 1272 1624 Faktura ref. # IRQ-21-07778.exe schtasks.exe PID 1624 wrote to memory of 1272 1624 Faktura ref. # IRQ-21-07778.exe schtasks.exe PID 1624 wrote to memory of 1272 1624 Faktura ref. # IRQ-21-07778.exe schtasks.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 1624 wrote to memory of 392 1624 Faktura ref. # IRQ-21-07778.exe Faktura ref. # IRQ-21-07778.exe PID 392 wrote to memory of 1544 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 1544 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 1544 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 1544 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 608 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 608 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 608 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 392 wrote to memory of 608 392 Faktura ref. # IRQ-21-07778.exe cmd.exe PID 1544 wrote to memory of 988 1544 cmd.exe schtasks.exe PID 1544 wrote to memory of 988 1544 cmd.exe schtasks.exe PID 1544 wrote to memory of 988 1544 cmd.exe schtasks.exe PID 1544 wrote to memory of 988 1544 cmd.exe schtasks.exe PID 608 wrote to memory of 1608 608 cmd.exe timeout.exe PID 608 wrote to memory of 1608 608 cmd.exe timeout.exe PID 608 wrote to memory of 1608 608 cmd.exe timeout.exe PID 608 wrote to memory of 1608 608 cmd.exe timeout.exe PID 608 wrote to memory of 968 608 cmd.exe chromeex.exe PID 608 wrote to memory of 968 608 cmd.exe chromeex.exe PID 608 wrote to memory of 968 608 cmd.exe chromeex.exe PID 608 wrote to memory of 968 608 cmd.exe chromeex.exe PID 968 wrote to memory of 1728 968 chromeex.exe powershell.exe PID 968 wrote to memory of 1728 968 chromeex.exe powershell.exe PID 968 wrote to memory of 1728 968 chromeex.exe powershell.exe PID 968 wrote to memory of 1728 968 chromeex.exe powershell.exe PID 968 wrote to memory of 1592 968 chromeex.exe schtasks.exe PID 968 wrote to memory of 1592 968 chromeex.exe schtasks.exe PID 968 wrote to memory of 1592 968 chromeex.exe schtasks.exe PID 968 wrote to memory of 1592 968 chromeex.exe schtasks.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe PID 968 wrote to memory of 956 968 chromeex.exe chromeex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Faktura ref. # IRQ-21-07778.exe"C:\Users\Admin\AppData\Local\Temp\Faktura ref. # IRQ-21-07778.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSbiuPFvZX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSbiuPFvZX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B9D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Faktura ref. # IRQ-21-07778.exe"C:\Users\Admin\AppData\Local\Temp\Faktura ref. # IRQ-21-07778.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeex" /tr '"C:\Users\Admin\AppData\Local\Temp\chromeex.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeex" /tr '"C:\Users\Admin\AppData\Local\Temp\chromeex.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA515.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\chromeex.exe"C:\Users\Admin\AppData\Local\Temp\chromeex.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSbiuPFvZX.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSbiuPFvZX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp421F.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\chromeex.exe"C:\Users\Admin\AppData\Local\Temp\chromeex.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chromeex.exeMD5
d2c4ad3484a598f0848a7947fc45175f
SHA12c7807352b5ece76d1e0364acdcfce3bc2cd9b72
SHA2561b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
SHA512366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
-
C:\Users\Admin\AppData\Local\Temp\chromeex.exeMD5
d2c4ad3484a598f0848a7947fc45175f
SHA12c7807352b5ece76d1e0364acdcfce3bc2cd9b72
SHA2561b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
SHA512366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
-
C:\Users\Admin\AppData\Local\Temp\chromeex.exeMD5
d2c4ad3484a598f0848a7947fc45175f
SHA12c7807352b5ece76d1e0364acdcfce3bc2cd9b72
SHA2561b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
SHA512366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
-
C:\Users\Admin\AppData\Local\Temp\tmp421F.tmpMD5
5085e4ffc0a7fbcacc4bbb2f3561688a
SHA12d53e470e5345df36c80f22168947655d4d4134a
SHA256d57312d171e9fe44cd2d29e868a30cda1e790a8ef0ab2dcabc840f0ea92a16cf
SHA512b8b9576fb2ecd18dd32acd4390edf020c9622ab6aabc9161a00f73d514da35aa8022d591e85afed22391cf1858e4785239a9dd4adc9a31a7ad9bf59e71340d1a
-
C:\Users\Admin\AppData\Local\Temp\tmp8B9D.tmpMD5
5085e4ffc0a7fbcacc4bbb2f3561688a
SHA12d53e470e5345df36c80f22168947655d4d4134a
SHA256d57312d171e9fe44cd2d29e868a30cda1e790a8ef0ab2dcabc840f0ea92a16cf
SHA512b8b9576fb2ecd18dd32acd4390edf020c9622ab6aabc9161a00f73d514da35aa8022d591e85afed22391cf1858e4785239a9dd4adc9a31a7ad9bf59e71340d1a
-
C:\Users\Admin\AppData\Local\Temp\tmpA515.tmp.batMD5
a20399caeccea5a8aa1d71791862f122
SHA161660c7ed81a10c5c73120a37f4a5d6ea26df053
SHA25651f65aa0313a238cc2baba323814743340e7631890e089e211c7d204f5bfaf03
SHA512dad6559cd617d1989872769183004be90392e80c7af60f446dc059e205e0a3b78d392332756db698852fa40835311f0cc6e7d178cf28456f54bfe84e3d67d7b7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0069da41edea4cce099a288475364d2b
SHA13602dfcaa64da16eab4a1787ae93b04867e748b8
SHA2562ca61ca89c10d0d6d9487fc125edad5360a51c148c1dda14cc728b200aeb2d1a
SHA5121592c5e5d02723f71e57b24b091d04b9be8799c147007a2cc8b28693c995e1f235e0313c9cfd22dd1be9453c49d97b06660d7243180b319363fedb3243911a3b
-
\Users\Admin\AppData\Local\Temp\chromeex.exeMD5
d2c4ad3484a598f0848a7947fc45175f
SHA12c7807352b5ece76d1e0364acdcfce3bc2cd9b72
SHA2561b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
SHA512366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
-
\Users\Admin\AppData\Local\Temp\chromeex.exeMD5
d2c4ad3484a598f0848a7947fc45175f
SHA12c7807352b5ece76d1e0364acdcfce3bc2cd9b72
SHA2561b662d7015e25e2eba4e7b535732df5310c28ddd80797c260eebadfed1a1197d
SHA512366f15e329de3e504cc2a91e17129377b07815f19cd849e30d776eadac0ad3d57f5b8b5182bfc2bd80ba99839903f794649310c21f46c3447662d762b1288b5e
-
memory/392-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-68-0x0000000002510000-0x0000000004610000-memory.dmpFilesize
33.0MB
-
memory/392-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/568-71-0x0000000002252000-0x0000000002254000-memory.dmpFilesize
8KB
-
memory/568-70-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/568-69-0x0000000002251000-0x0000000002252000-memory.dmpFilesize
4KB
-
memory/956-96-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/968-78-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/968-76-0x0000000000CC0000-0x0000000000D74000-memory.dmpFilesize
720KB
-
memory/968-79-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1624-58-0x0000000005540000-0x00000000055C0000-memory.dmpFilesize
512KB
-
memory/1624-57-0x0000000000B40000-0x0000000000B4E000-memory.dmpFilesize
56KB
-
memory/1624-56-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1624-55-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/1624-54-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1624-53-0x0000000001050000-0x0000000001104000-memory.dmpFilesize
720KB
-
memory/1728-92-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/1728-93-0x0000000002450000-0x0000000002493000-memory.dmpFilesize
268KB
-
memory/1728-94-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB