Analysis
-
max time kernel
4294182s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
24-02-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
db73de377b65213640e910db6f18f33f.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
db73de377b65213640e910db6f18f33f.exe
Resource
win10v2004-en-20220113
General
-
Target
db73de377b65213640e910db6f18f33f.exe
-
Size
671KB
-
MD5
db73de377b65213640e910db6f18f33f
-
SHA1
b5d30bcb05b536b7736be7c49502a39c24281f82
-
SHA256
ddb0822b3ff456aa4d91bf7356b01193a63b0e333d1a4c281e7b7c18733b8fd8
-
SHA512
51a6535256262071ea520cceba1c84c395b23cb630b5c97f881205c6bec34bd4b3e06ff2ec3d80932d3194b22f63fc84b08e22adaa7f6639661e7643a9950c05
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2012-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2012-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2012-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
db73de377b65213640e910db6f18f33f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xczxwi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xhaslxdcw\\Xczxwi.exe\"" db73de377b65213640e910db6f18f33f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
db73de377b65213640e910db6f18f33f.exedescription pid process target process PID 1616 set thread context of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1948 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
db73de377b65213640e910db6f18f33f.exepid process 1616 db73de377b65213640e910db6f18f33f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
db73de377b65213640e910db6f18f33f.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1616 db73de377b65213640e910db6f18f33f.exe Token: SeDebugPrivilege 2012 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
db73de377b65213640e910db6f18f33f.execmd.exedescription pid process target process PID 1616 wrote to memory of 1144 1616 db73de377b65213640e910db6f18f33f.exe cmd.exe PID 1616 wrote to memory of 1144 1616 db73de377b65213640e910db6f18f33f.exe cmd.exe PID 1616 wrote to memory of 1144 1616 db73de377b65213640e910db6f18f33f.exe cmd.exe PID 1616 wrote to memory of 1144 1616 db73de377b65213640e910db6f18f33f.exe cmd.exe PID 1144 wrote to memory of 1948 1144 cmd.exe timeout.exe PID 1144 wrote to memory of 1948 1144 cmd.exe timeout.exe PID 1144 wrote to memory of 1948 1144 cmd.exe timeout.exe PID 1144 wrote to memory of 1948 1144 cmd.exe timeout.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe PID 1616 wrote to memory of 2012 1616 db73de377b65213640e910db6f18f33f.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db73de377b65213640e910db6f18f33f.exe"C:\Users\Admin\AppData\Local\Temp\db73de377b65213640e910db6f18f33f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1616-54-0x0000000074BEE000-0x0000000074BEF000-memory.dmpFilesize
4KB
-
memory/1616-55-0x0000000000AF0000-0x0000000000B9E000-memory.dmpFilesize
696KB
-
memory/1616-56-0x0000000076731000-0x0000000076733000-memory.dmpFilesize
8KB
-
memory/1616-57-0x0000000004F00000-0x0000000004F9E000-memory.dmpFilesize
632KB
-
memory/1616-58-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1616-59-0x0000000004980000-0x00000000049CC000-memory.dmpFilesize
304KB
-
memory/2012-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2012-66-0x0000000074BEE000-0x0000000074BEF000-memory.dmpFilesize
4KB
-
memory/2012-68-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB