Analysis
-
max time kernel
122s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 20:47
Static task
static1
Behavioral task
behavioral1
Sample
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe
Resource
win7-en-20211208
General
-
Target
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe
-
Size
852KB
-
MD5
5f76c9bd05993fdf6bd65c3fef5155fc
-
SHA1
e9d93be03d0acbb25c5eb94303bd260403ec673e
-
SHA256
e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
-
SHA512
b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
bdeyjxzfhfrvuzdyrin
-
anti_vm
false
-
bsod
false
-
delay
1
-
install
true
-
install_file
firefoxa.exe
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3536-123-0x0000000005770000-0x0000000005782000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
firefoxa.exepid process 4336 firefoxa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 364 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exepid process 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exefirefoxa.exedescription pid process Token: SeDebugPrivilege 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe Token: SeDebugPrivilege 4336 firefoxa.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.execmd.execmd.exedescription pid process target process PID 3536 wrote to memory of 436 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3536 wrote to memory of 436 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3536 wrote to memory of 436 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3536 wrote to memory of 3456 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3536 wrote to memory of 3456 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3536 wrote to memory of 3456 3536 E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe cmd.exe PID 3456 wrote to memory of 364 3456 cmd.exe timeout.exe PID 3456 wrote to memory of 364 3456 cmd.exe timeout.exe PID 3456 wrote to memory of 364 3456 cmd.exe timeout.exe PID 436 wrote to memory of 1632 436 cmd.exe schtasks.exe PID 436 wrote to memory of 1632 436 cmd.exe schtasks.exe PID 436 wrote to memory of 1632 436 cmd.exe schtasks.exe PID 3456 wrote to memory of 4336 3456 cmd.exe firefoxa.exe PID 3456 wrote to memory of 4336 3456 cmd.exe firefoxa.exe PID 3456 wrote to memory of 4336 3456 cmd.exe firefoxa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe"C:\Users\Admin\AppData\Local\Temp\E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn E079B3BA7C32C3C605ED795D257DAD51FEA2BB2C463CB /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF657.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\firefoxa.exe"C:\Users\Admin\AppData\Roaming\firefoxa.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF657.tmp.batMD5
1cb0cd1d3f728a484f1e7bb359c5c71d
SHA1b9d657caf36a15ea0930f924b78d8befbd915d7c
SHA2562b0d5d28ba78e47f23b78915a5f93f1439f0c41eb1e3e63e2939adc73f6f7dd5
SHA512c1f80590e97588c40566a425bcdd95e6f85bf11c9fd76212e40887395cdb21a27dcd734196599bd25c54a1c16f1351d68259204ad4338c32deb2f4a0e695b422
-
C:\Users\Admin\AppData\Roaming\firefoxa.exeMD5
5f76c9bd05993fdf6bd65c3fef5155fc
SHA1e9d93be03d0acbb25c5eb94303bd260403ec673e
SHA256e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
SHA512b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
-
C:\Users\Admin\AppData\Roaming\firefoxa.exeMD5
5f76c9bd05993fdf6bd65c3fef5155fc
SHA1e9d93be03d0acbb25c5eb94303bd260403ec673e
SHA256e079b3ba7c32c3c605ed795d257dad51fea2bb2c463cb04a2fb41f99ed7898bb
SHA512b258b402bf23dc0b8b35cd8364466993b694ae91c58f52095602eff5716e3bbe9fc86fcca0028b2474f1cf414a61c91c0ea0bac0ea1e047ce5932a7edd68d348
-
memory/3536-118-0x0000000000ED0000-0x0000000000FAA000-memory.dmpFilesize
872KB
-
memory/3536-119-0x0000000005C60000-0x000000000615E000-memory.dmpFilesize
5.0MB
-
memory/3536-120-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/3536-121-0x0000000005940000-0x00000000059DC000-memory.dmpFilesize
624KB
-
memory/3536-122-0x0000000003380000-0x0000000003391000-memory.dmpFilesize
68KB
-
memory/3536-123-0x0000000005770000-0x0000000005782000-memory.dmpFilesize
72KB
-
memory/4336-127-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/4336-128-0x0000000006540000-0x00000000065A6000-memory.dmpFilesize
408KB