Analysis
-
max time kernel
4294178s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
25-02-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe
Resource
win10v2004-en-20220113
General
-
Target
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe
-
Size
668KB
-
MD5
1dfb8f4b408ad8a763e4655e90c07093
-
SHA1
be332a245adcd81707dd3de6b60653e2f68a0256
-
SHA256
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979
-
SHA512
a7af9a29cc5942ca67473f0f25f919bd22b6510b8f9738121dbac2f248dcfdbadc086097c120e00bba3df1fd08f7881d54fa3ec0a3775a0ab01219aa5991f9df
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1052-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1052-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1052-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1052-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xhdgkfv = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wdnzjeuy\\Xhdgkfv.exe\"" a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exedescription pid process target process PID 1204 set thread context of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1180 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exepid process 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe Token: SeDebugPrivilege 1052 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.execmd.exedescription pid process target process PID 1204 wrote to memory of 652 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 1204 wrote to memory of 652 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 1204 wrote to memory of 652 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 1204 wrote to memory of 652 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe cmd.exe PID 652 wrote to memory of 1180 652 cmd.exe timeout.exe PID 652 wrote to memory of 1180 652 cmd.exe timeout.exe PID 652 wrote to memory of 1180 652 cmd.exe timeout.exe PID 652 wrote to memory of 1180 652 cmd.exe timeout.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe PID 1204 wrote to memory of 1052 1204 a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe"C:\Users\Admin\AppData\Local\Temp\a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-68-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/1052-66-0x00000000739FE000-0x00000000739FF000-memory.dmpFilesize
4KB
-
memory/1052-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1052-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1204-55-0x0000000074E31000-0x0000000074E33000-memory.dmpFilesize
8KB
-
memory/1204-54-0x0000000000020000-0x00000000000CE000-memory.dmpFilesize
696KB
-
memory/1204-59-0x0000000004AA0000-0x0000000004AEC000-memory.dmpFilesize
304KB
-
memory/1204-58-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/1204-57-0x00000000051E0000-0x000000000527E000-memory.dmpFilesize
632KB
-
memory/1204-56-0x00000000740EE000-0x00000000740EF000-memory.dmpFilesize
4KB