Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 05:16
Behavioral task
behavioral1
Sample
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe
Resource
win10v2004-en-20220112
General
-
Target
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe
-
Size
46KB
-
MD5
6aeffcb0f2c4703a35309f019e001822
-
SHA1
2b3237ca7a252a96997263575fbb96e9d2f24320
-
SHA256
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3
-
SHA512
87af7919630a99b17839f14d558e091985ecc3e67597cd8445e0ab1ae06bf3205d4e148958f6d298f41defbab9139f17868a580aecd6bd1b9061aae8d17d7d3d
Malware Config
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-130-0x0000000000B90000-0x0000000000BA2000-memory.dmp asyncrat C:\Users\Admin\AppData\Local\Temp\Update.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Update.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Update.exepid process 3636 Update.exe -
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1540 timeout.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exeUpdate.exepid process 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe 3636 Update.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exeUpdate.exedescription pid process Token: SeDebugPrivilege 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe Token: SeDebugPrivilege 3636 Update.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.execmd.exedescription pid process target process PID 1216 wrote to memory of 544 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe schtasks.exe PID 1216 wrote to memory of 544 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe schtasks.exe PID 1216 wrote to memory of 2824 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe cmd.exe PID 1216 wrote to memory of 2824 1216 87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe cmd.exe PID 2824 wrote to memory of 1540 2824 cmd.exe timeout.exe PID 2824 wrote to memory of 1540 2824 cmd.exe timeout.exe PID 2824 wrote to memory of 3636 2824 cmd.exe Update.exe PID 2824 wrote to memory of 3636 2824 cmd.exe Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe"C:\Users\Admin\AppData\Local\Temp\87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'Update"' /tr "'C:\Users\Admin\AppData\Local\Temp\Update.exe"'2⤵
- Creates scheduled task(s)
PID:544 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4917.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 999b14937e7a9d15c5ac465b0f47315f NZEgRxQceUqaoGTnPodVoA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:1548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Update.exeMD5
612168926dbed3bb84daa6606a9eff23
SHA1d40e59f5b5b5e44b2ffaf9ecf8c47b2f3c9df235
SHA256b60e1c63b5d21e5750c346fbe9a2eefd6afa4d4f77c316e65f6c00c0c63b0c52
SHA512c3ddfc6fac52c51138185d44a1cfce6d8419ef2e1b881dfc721d8c6483f1551428ccd41320686cdb021b3f56bbb879ecfe443dd2e9a4c1f22282c132a4e556d1
-
C:\Users\Admin\AppData\Local\Temp\Update.exeMD5
612168926dbed3bb84daa6606a9eff23
SHA1d40e59f5b5b5e44b2ffaf9ecf8c47b2f3c9df235
SHA256b60e1c63b5d21e5750c346fbe9a2eefd6afa4d4f77c316e65f6c00c0c63b0c52
SHA512c3ddfc6fac52c51138185d44a1cfce6d8419ef2e1b881dfc721d8c6483f1551428ccd41320686cdb021b3f56bbb879ecfe443dd2e9a4c1f22282c132a4e556d1
-
C:\Users\Admin\AppData\Local\Temp\tmp4917.tmp.batMD5
6b0c3f8d9725bbd57adaf95092b438d0
SHA1e49f8a1b6dc09ac378f95984aa93529fe90d79b7
SHA2563b54f100aa17bfe26bf4cfa5a90a08dc1eeafc31aaf0c3dde50cd67d416381ef
SHA512989505c39d6db60df9e5bf49586d0423a344c6cdbd62306fea07c2f5905c21cf6ce415143da5b5d793533a89fc66389f8b92a457300483629e02c101a1198e14
-
memory/1216-130-0x0000000000B90000-0x0000000000BA2000-memory.dmpFilesize
72KB
-
memory/1216-131-0x000000001D970000-0x000000001D972000-memory.dmpFilesize
8KB
-
memory/3636-239-0x0000000000700000-0x0000000000740000-memory.dmpFilesize
256KB