Analysis
-
max time kernel
153s -
max time network
169s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 07:26
Static task
static1
Behavioral task
behavioral1
Sample
PO_9878xls.exe
Resource
win7-en-20211208
General
-
Target
PO_9878xls.exe
-
Size
300KB
-
MD5
4b779a236a8eae2bb4ee28cd99e7150c
-
SHA1
5ef6353ed24b0350212ffee3e01a872ff7bedf10
-
SHA256
0a0445acf374b31a19805593309ff48a3b0220b2a03e9d153d8788975bb9172e
-
SHA512
2fac5c2ae97f042d1ba974e18ab86ab2dbb62634722aab3185024924e5bdd8b06a28a691510dfbb8454809f7f9c647ef6a8f14909068221875f4dc01a89c435b
Malware Config
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1072-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1072-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1072-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1392-84-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
svvhst.exesvvhst.exepid process 928 svvhst.exe 1392 svvhst.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1340 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
PO_9878xls.exesvvhst.exedescription pid process target process PID 1660 set thread context of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 928 set thread context of 1392 928 svvhst.exe svvhst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1516 schtasks.exe 1004 schtasks.exe 1356 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1956 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PO_9878xls.exePO_9878xls.exepid process 1660 PO_9878xls.exe 1072 PO_9878xls.exe 1072 PO_9878xls.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_9878xls.exePO_9878xls.exesvvhst.exedescription pid process Token: SeDebugPrivilege 1660 PO_9878xls.exe Token: SeDebugPrivilege 1072 PO_9878xls.exe Token: SeDebugPrivilege 1392 svvhst.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
PO_9878xls.exePO_9878xls.execmd.execmd.exesvvhst.exedescription pid process target process PID 1660 wrote to memory of 1516 1660 PO_9878xls.exe schtasks.exe PID 1660 wrote to memory of 1516 1660 PO_9878xls.exe schtasks.exe PID 1660 wrote to memory of 1516 1660 PO_9878xls.exe schtasks.exe PID 1660 wrote to memory of 1516 1660 PO_9878xls.exe schtasks.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1660 wrote to memory of 1072 1660 PO_9878xls.exe PO_9878xls.exe PID 1072 wrote to memory of 1288 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1288 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1288 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1288 1072 PO_9878xls.exe cmd.exe PID 1288 wrote to memory of 1004 1288 cmd.exe schtasks.exe PID 1288 wrote to memory of 1004 1288 cmd.exe schtasks.exe PID 1288 wrote to memory of 1004 1288 cmd.exe schtasks.exe PID 1288 wrote to memory of 1004 1288 cmd.exe schtasks.exe PID 1072 wrote to memory of 1340 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1340 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1340 1072 PO_9878xls.exe cmd.exe PID 1072 wrote to memory of 1340 1072 PO_9878xls.exe cmd.exe PID 1340 wrote to memory of 1956 1340 cmd.exe timeout.exe PID 1340 wrote to memory of 1956 1340 cmd.exe timeout.exe PID 1340 wrote to memory of 1956 1340 cmd.exe timeout.exe PID 1340 wrote to memory of 1956 1340 cmd.exe timeout.exe PID 1340 wrote to memory of 928 1340 cmd.exe svvhst.exe PID 1340 wrote to memory of 928 1340 cmd.exe svvhst.exe PID 1340 wrote to memory of 928 1340 cmd.exe svvhst.exe PID 1340 wrote to memory of 928 1340 cmd.exe svvhst.exe PID 928 wrote to memory of 1356 928 svvhst.exe schtasks.exe PID 928 wrote to memory of 1356 928 svvhst.exe schtasks.exe PID 928 wrote to memory of 1356 928 svvhst.exe schtasks.exe PID 928 wrote to memory of 1356 928 svvhst.exe schtasks.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe PID 928 wrote to memory of 1392 928 svvhst.exe svvhst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_9878xls.exe"C:\Users\Admin\AppData\Local\Temp\PO_9878xls.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PSkCOJJISk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DEA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO_9878xls.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svvhst" /tr '"C:\Users\Admin\AppData\Roaming\svvhst.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svvhst" /tr '"C:\Users\Admin\AppData\Roaming\svvhst.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7ACB.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svvhst.exe"C:\Users\Admin\AppData\Roaming\svvhst.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PSkCOJJISk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF029.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\svvhst.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3DEA.tmpMD5
39ed630102909888d53659c5401ac516
SHA1b4dbff82bfedd26fc904d775f4514960491c90f1
SHA256940466fe0872f629d1fb04f35c857d576dab9cac8d7753d2ea9cbddccc0b57a6
SHA512862f1be14b280112ce4bafc7e3fafb2bac61e1ee787cd90a4e5c367243d4d2722d263a191e9d384c9f179cff88b4c053ddc2d825a65c1e96d986edf5bd51ac6d
-
C:\Users\Admin\AppData\Local\Temp\tmp7ACB.tmp.batMD5
863029f760e44f41eba1cb0713e63e13
SHA1122ab51ba455361c20824b7cd3b5f82f7731963a
SHA256477bbec8b154152b0a01d3df0add36f02ebc9dc6bc4f59227a3b04c141f7f805
SHA5120a34c8a9817d5d7027ee6c2af8434a8e4fa0007d768af1aedc20bad35012688f8b9abbab5a349803463782354cce2835e9485e9cd4a67f8fa6c2e586ce2b11e1
-
C:\Users\Admin\AppData\Local\Temp\tmpF029.tmpMD5
39ed630102909888d53659c5401ac516
SHA1b4dbff82bfedd26fc904d775f4514960491c90f1
SHA256940466fe0872f629d1fb04f35c857d576dab9cac8d7753d2ea9cbddccc0b57a6
SHA512862f1be14b280112ce4bafc7e3fafb2bac61e1ee787cd90a4e5c367243d4d2722d263a191e9d384c9f179cff88b4c053ddc2d825a65c1e96d986edf5bd51ac6d
-
C:\Users\Admin\AppData\Roaming\svvhst.exeMD5
4b779a236a8eae2bb4ee28cd99e7150c
SHA15ef6353ed24b0350212ffee3e01a872ff7bedf10
SHA2560a0445acf374b31a19805593309ff48a3b0220b2a03e9d153d8788975bb9172e
SHA5122fac5c2ae97f042d1ba974e18ab86ab2dbb62634722aab3185024924e5bdd8b06a28a691510dfbb8454809f7f9c647ef6a8f14909068221875f4dc01a89c435b
-
C:\Users\Admin\AppData\Roaming\svvhst.exeMD5
4b779a236a8eae2bb4ee28cd99e7150c
SHA15ef6353ed24b0350212ffee3e01a872ff7bedf10
SHA2560a0445acf374b31a19805593309ff48a3b0220b2a03e9d153d8788975bb9172e
SHA5122fac5c2ae97f042d1ba974e18ab86ab2dbb62634722aab3185024924e5bdd8b06a28a691510dfbb8454809f7f9c647ef6a8f14909068221875f4dc01a89c435b
-
C:\Users\Admin\AppData\Roaming\svvhst.exeMD5
4b779a236a8eae2bb4ee28cd99e7150c
SHA15ef6353ed24b0350212ffee3e01a872ff7bedf10
SHA2560a0445acf374b31a19805593309ff48a3b0220b2a03e9d153d8788975bb9172e
SHA5122fac5c2ae97f042d1ba974e18ab86ab2dbb62634722aab3185024924e5bdd8b06a28a691510dfbb8454809f7f9c647ef6a8f14909068221875f4dc01a89c435b
-
\Users\Admin\AppData\Roaming\svvhst.exeMD5
4b779a236a8eae2bb4ee28cd99e7150c
SHA15ef6353ed24b0350212ffee3e01a872ff7bedf10
SHA2560a0445acf374b31a19805593309ff48a3b0220b2a03e9d153d8788975bb9172e
SHA5122fac5c2ae97f042d1ba974e18ab86ab2dbb62634722aab3185024924e5bdd8b06a28a691510dfbb8454809f7f9c647ef6a8f14909068221875f4dc01a89c435b
-
memory/928-74-0x0000000000E90000-0x0000000000EE2000-memory.dmpFilesize
328KB
-
memory/928-76-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/1072-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1072-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1072-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1072-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1072-69-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/1072-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1072-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1392-86-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/1392-84-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1660-59-0x0000000002050000-0x00000000020B8000-memory.dmpFilesize
416KB
-
memory/1660-55-0x0000000000B80000-0x0000000000BD2000-memory.dmpFilesize
328KB
-
memory/1660-57-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB
-
memory/1660-56-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/1660-58-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/1660-60-0x00000000005F0000-0x0000000000602000-memory.dmpFilesize
72KB