Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 15:19
Static task
static1
Behavioral task
behavioral1
Sample
f8111a92842e5e377c21f38d3f355911.exe
Resource
win7-en-20211208
General
-
Target
f8111a92842e5e377c21f38d3f355911.exe
-
Size
303KB
-
MD5
f8111a92842e5e377c21f38d3f355911
-
SHA1
6a5d2c528430b1ff8813fc01c522b5a4b6cf4494
-
SHA256
20126f0e6a271df71f9ab0838c03bb6554b106773f66fb9c28eb7bf4e685399d
-
SHA512
aed02a61ffc1567d12ac05a8d5b32c7c8635059dd2713e2b8cd5e0a434c46618ae9f7cc528e09c862e8d5228471e6a67533c19545d05683fd642cdb237d8ec15
Malware Config
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1036-130-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f8111a92842e5e377c21f38d3f355911.exedescription pid process target process PID 3520 set thread context of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1808 powershell.exe 1808 powershell.exe 1808 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1808 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f8111a92842e5e377c21f38d3f355911.exedescription pid process target process PID 3520 wrote to memory of 1808 3520 f8111a92842e5e377c21f38d3f355911.exe powershell.exe PID 3520 wrote to memory of 1808 3520 f8111a92842e5e377c21f38d3f355911.exe powershell.exe PID 3520 wrote to memory of 1808 3520 f8111a92842e5e377c21f38d3f355911.exe powershell.exe PID 3520 wrote to memory of 1824 3520 f8111a92842e5e377c21f38d3f355911.exe schtasks.exe PID 3520 wrote to memory of 1824 3520 f8111a92842e5e377c21f38d3f355911.exe schtasks.exe PID 3520 wrote to memory of 1824 3520 f8111a92842e5e377c21f38d3f355911.exe schtasks.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe PID 3520 wrote to memory of 1036 3520 f8111a92842e5e377c21f38d3f355911.exe f8111a92842e5e377c21f38d3f355911.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8111a92842e5e377c21f38d3f355911.exe"C:\Users\Admin\AppData\Local\Temp\f8111a92842e5e377c21f38d3f355911.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DmmczBXpJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DmmczBXpJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59F3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\f8111a92842e5e377c21f38d3f355911.exe"C:\Users\Admin\AppData\Local\Temp\f8111a92842e5e377c21f38d3f355911.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f8111a92842e5e377c21f38d3f355911.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmp59F3.tmpMD5
88bb8116f55cb4fdb74707f156ac0b2e
SHA154aab613575465cc0ce187a7d98b042e989388d3
SHA25686e6e000d615a111441c1add993cc6fcc0518277c332b8f184a44e5520f57f44
SHA512239e9003d9cb26c2c07c1b95ba67f903633f0dbd881a7b178325ab12b4d000ccc378731c362aafd07d59578aaa82d9b51203783d9adf674583c0f94e32d0fd8c
-
memory/1036-139-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/1036-130-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1808-140-0x0000000007980000-0x000000000799C000-memory.dmpFilesize
112KB
-
memory/1808-151-0x0000000009320000-0x0000000009353000-memory.dmpFilesize
204KB
-
memory/1808-358-0x0000000008310000-0x0000000008318000-memory.dmpFilesize
32KB
-
memory/1808-353-0x0000000009540000-0x000000000955A000-memory.dmpFilesize
104KB
-
memory/1808-160-0x0000000002EF3000-0x0000000002EF4000-memory.dmpFilesize
4KB
-
memory/1808-129-0x0000000002F00000-0x0000000002F36000-memory.dmpFilesize
216KB
-
memory/1808-159-0x00000000095E0000-0x0000000009674000-memory.dmpFilesize
592KB
-
memory/1808-158-0x000000007EB70000-0x000000007EB71000-memory.dmpFilesize
4KB
-
memory/1808-132-0x0000000007210000-0x0000000007838000-memory.dmpFilesize
6.2MB
-
memory/1808-133-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/1808-134-0x0000000002EF2000-0x0000000002EF3000-memory.dmpFilesize
4KB
-
memory/1808-135-0x0000000007030000-0x0000000007052000-memory.dmpFilesize
136KB
-
memory/1808-136-0x00000000078B0000-0x0000000007916000-memory.dmpFilesize
408KB
-
memory/1808-137-0x0000000007B00000-0x0000000007B66000-memory.dmpFilesize
408KB
-
memory/1808-138-0x0000000007B70000-0x0000000007EC0000-memory.dmpFilesize
3.3MB
-
memory/1808-157-0x0000000009450000-0x00000000094F5000-memory.dmpFilesize
660KB
-
memory/1808-141-0x00000000079A0000-0x00000000079EB000-memory.dmpFilesize
300KB
-
memory/1808-152-0x0000000009300000-0x000000000931E000-memory.dmpFilesize
120KB
-
memory/1808-142-0x00000000081E0000-0x0000000008256000-memory.dmpFilesize
472KB
-
memory/3520-123-0x00000000055B0000-0x00000000055C6000-memory.dmpFilesize
88KB
-
memory/3520-118-0x0000000000AF0000-0x0000000000B42000-memory.dmpFilesize
328KB
-
memory/3520-119-0x0000000005970000-0x0000000005E6E000-memory.dmpFilesize
5.0MB
-
memory/3520-120-0x0000000005390000-0x0000000005422000-memory.dmpFilesize
584KB
-
memory/3520-121-0x0000000005370000-0x000000000537A000-memory.dmpFilesize
40KB
-
memory/3520-122-0x0000000005470000-0x000000000596E000-memory.dmpFilesize
5.0MB
-
memory/3520-125-0x0000000007B30000-0x0000000007B68000-memory.dmpFilesize
224KB
-
memory/3520-124-0x0000000007A20000-0x0000000007ABC000-memory.dmpFilesize
624KB