Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-02-2022 08:14
Static task
static1
Behavioral task
behavioral1
Sample
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe
Resource
win10-en-20211208
General
-
Target
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe
-
Size
668KB
-
MD5
1dfb8f4b408ad8a763e4655e90c07093
-
SHA1
be332a245adcd81707dd3de6b60653e2f68a0256
-
SHA256
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979
-
SHA512
a7af9a29cc5942ca67473f0f25f919bd22b6510b8f9738121dbac2f248dcfdbadc086097c120e00bba3df1fd08f7881d54fa3ec0a3775a0ab01219aa5991f9df
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3476-121-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xhdgkfv = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wdnzjeuy\\Xhdgkfv.exe\"" a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exedescription pid process target process PID 5112 set thread context of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3876 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exepid process 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exedescription pid process Token: SeDebugPrivilege 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.execmd.exedescription pid process target process PID 5112 wrote to memory of 4196 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 5112 wrote to memory of 4196 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 5112 wrote to memory of 4196 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 4196 wrote to memory of 3876 4196 cmd.exe timeout.exe PID 4196 wrote to memory of 3876 4196 cmd.exe timeout.exe PID 4196 wrote to memory of 3876 4196 cmd.exe timeout.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 5112 wrote to memory of 3476 5112 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe"C:\Users\Admin\AppData\Local\Temp\a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3476-121-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3476-122-0x000000007323E000-0x000000007323F000-memory.dmpFilesize
4KB
-
memory/3476-123-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/5112-115-0x000000007323E000-0x000000007323F000-memory.dmpFilesize
4KB
-
memory/5112-116-0x0000000000770000-0x000000000081E000-memory.dmpFilesize
696KB
-
memory/5112-117-0x0000000005AA0000-0x0000000005B3E000-memory.dmpFilesize
632KB
-
memory/5112-118-0x0000000005B40000-0x0000000005B8C000-memory.dmpFilesize
304KB
-
memory/5112-119-0x0000000001300000-0x0000000001301000-memory.dmpFilesize
4KB
-
memory/5112-120-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB