Analysis
-
max time kernel
117s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
26-01-2022 20:47
Static task
static1
Behavioral task
behavioral1
Sample
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe
Resource
win7-en-20211208
General
-
Target
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe
-
Size
852KB
-
MD5
5f76c9bd05993fdf6bd65c3fef5155fc
-
SHA1
e9d93be03d0acbb25c5eb94303bd260403ec673e
-
SHA256
e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
-
SHA512
b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
bdeyjxzfhfrvuzdyrin
-
anti_vm
false
-
bsod
false
-
delay
1
-
install
true
-
install_file
firefoxa.exe
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/760-55-0x0000000000500000-0x0000000000512000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
firefoxa.exepid process 1448 firefoxa.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 892 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1384 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exepid process 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exefirefoxa.exedescription pid process Token: SeDebugPrivilege 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe Token: SeDebugPrivilege 1448 firefoxa.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.execmd.execmd.exedescription pid process target process PID 760 wrote to memory of 472 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 472 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 472 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 472 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 892 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 892 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 892 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 760 wrote to memory of 892 760 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 472 wrote to memory of 1644 472 cmd.exe schtasks.exe PID 472 wrote to memory of 1644 472 cmd.exe schtasks.exe PID 472 wrote to memory of 1644 472 cmd.exe schtasks.exe PID 472 wrote to memory of 1644 472 cmd.exe schtasks.exe PID 892 wrote to memory of 1384 892 cmd.exe timeout.exe PID 892 wrote to memory of 1384 892 cmd.exe timeout.exe PID 892 wrote to memory of 1384 892 cmd.exe timeout.exe PID 892 wrote to memory of 1384 892 cmd.exe timeout.exe PID 892 wrote to memory of 1448 892 cmd.exe firefoxa.exe PID 892 wrote to memory of 1448 892 cmd.exe firefoxa.exe PID 892 wrote to memory of 1448 892 cmd.exe firefoxa.exe PID 892 wrote to memory of 1448 892 cmd.exe firefoxa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe"C:\Users\Admin\AppData\Local\Temp\E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp147A.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\firefoxa.exe"C:\Users\Admin\AppData\Roaming\firefoxa.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp147A.tmp.batMD5
1f1635835142bb9c79869d99c3e70c1f
SHA1285ac94d611a953eb048d235d53d15bb567e2226
SHA2568acc156c12d1b5f77b5f7e7d2a9b4524b0d34add833d4221e625e52e4f85dc1d
SHA512cc956ab6d0ffe0fe708062282bef8182da3d71cc8041544200c125226ae012aca9a3cbc4e8f6000dde02868674f408ac757fd740bfefdf1fa66587c162007fdc
-
C:\Users\Admin\AppData\Roaming\firefoxa.exeMD5
5f76c9bd05993fdf6bd65c3fef5155fc
SHA1e9d93be03d0acbb25c5eb94303bd260403ec673e
SHA256e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
SHA512b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
-
C:\Users\Admin\AppData\Roaming\firefoxa.exeMD5
5f76c9bd05993fdf6bd65c3fef5155fc
SHA1e9d93be03d0acbb25c5eb94303bd260403ec673e
SHA256e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
SHA512b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
-
\Users\Admin\AppData\Roaming\firefoxa.exeMD5
5f76c9bd05993fdf6bd65c3fef5155fc
SHA1e9d93be03d0acbb25c5eb94303bd260403ec673e
SHA256e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
SHA512b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
-
memory/760-53-0x00000000000B0000-0x000000000018A000-memory.dmpFilesize
872KB
-
memory/760-54-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/760-55-0x0000000000500000-0x0000000000512000-memory.dmpFilesize
72KB
-
memory/760-56-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1448-61-0x0000000001220000-0x00000000012FA000-memory.dmpFilesize
872KB
-
memory/1448-62-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB