Analysis
-
max time kernel
131s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:41
Static task
static1
Behavioral task
behavioral1
Sample
Doc#662020094753525765678.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Doc#662020094753525765678.exe
Resource
win10v2004-20220414-en
General
-
Target
Doc#662020094753525765678.exe
-
Size
301KB
-
MD5
9b70f0dee9fa7de571b2c08a6f3a9a75
-
SHA1
f3ad5f3cabe73c60c795c3367faaca682ddc1cc9
-
SHA256
249b086fbb970eefa5bc4c9bcebcda1e8a638ed82a1bbf1a106cfe3807e3e121
-
SHA512
2d47ea2d01e5643e5e5bec7e4b44e2c6cbc5c69f233bef27def943343403733a484baa58b90699f8ca29be52086750d505c47d876f8076ca363797be2f5badd7
Malware Config
Extracted
asyncrat
0.5.7B
DIRECT
chizzy25@@!7^UPCAZ
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/HKYwiN9V
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-73-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1492-74-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1492-76-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1492-79-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1492-78-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1492-83-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat behavioral1/memory/1492-86-0x0000000000080000-0x0000000000092000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
dwrn.exeAddInProcess32.exepid process 1260 dwrn.exe 1492 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
Doc#662020094753525765678.exedwrn.exepid process 2016 Doc#662020094753525765678.exe 1260 dwrn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ggxdtysjyux = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\dwrn.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dwrn.exedescription pid process target process PID 1260 set thread context of 1492 1260 dwrn.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Doc#662020094753525765678.exedwrn.exepid process 2016 Doc#662020094753525765678.exe 2016 Doc#662020094753525765678.exe 1260 dwrn.exe 1260 dwrn.exe 1260 dwrn.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Doc#662020094753525765678.exedwrn.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2016 Doc#662020094753525765678.exe Token: SeDebugPrivilege 1260 dwrn.exe Token: SeDebugPrivilege 1492 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Doc#662020094753525765678.execmd.exedwrn.exedescription pid process target process PID 2016 wrote to memory of 1220 2016 Doc#662020094753525765678.exe cmd.exe PID 2016 wrote to memory of 1220 2016 Doc#662020094753525765678.exe cmd.exe PID 2016 wrote to memory of 1220 2016 Doc#662020094753525765678.exe cmd.exe PID 2016 wrote to memory of 1220 2016 Doc#662020094753525765678.exe cmd.exe PID 1220 wrote to memory of 1736 1220 cmd.exe reg.exe PID 1220 wrote to memory of 1736 1220 cmd.exe reg.exe PID 1220 wrote to memory of 1736 1220 cmd.exe reg.exe PID 1220 wrote to memory of 1736 1220 cmd.exe reg.exe PID 2016 wrote to memory of 1260 2016 Doc#662020094753525765678.exe dwrn.exe PID 2016 wrote to memory of 1260 2016 Doc#662020094753525765678.exe dwrn.exe PID 2016 wrote to memory of 1260 2016 Doc#662020094753525765678.exe dwrn.exe PID 2016 wrote to memory of 1260 2016 Doc#662020094753525765678.exe dwrn.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe PID 1260 wrote to memory of 1492 1260 dwrn.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc#662020094753525765678.exe"C:\Users\Admin\AppData\Local\Temp\Doc#662020094753525765678.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v ggxdtysjyux /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\dwrn.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v ggxdtysjyux /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\dwrn.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\dwrn.exe"C:\Users\Admin\AppData\Roaming\dwrn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Roaming\dwrn.exeFilesize
301KB
MD59b70f0dee9fa7de571b2c08a6f3a9a75
SHA1f3ad5f3cabe73c60c795c3367faaca682ddc1cc9
SHA256249b086fbb970eefa5bc4c9bcebcda1e8a638ed82a1bbf1a106cfe3807e3e121
SHA5122d47ea2d01e5643e5e5bec7e4b44e2c6cbc5c69f233bef27def943343403733a484baa58b90699f8ca29be52086750d505c47d876f8076ca363797be2f5badd7
-
C:\Users\Admin\AppData\Roaming\dwrn.exeFilesize
301KB
MD59b70f0dee9fa7de571b2c08a6f3a9a75
SHA1f3ad5f3cabe73c60c795c3367faaca682ddc1cc9
SHA256249b086fbb970eefa5bc4c9bcebcda1e8a638ed82a1bbf1a106cfe3807e3e121
SHA5122d47ea2d01e5643e5e5bec7e4b44e2c6cbc5c69f233bef27def943343403733a484baa58b90699f8ca29be52086750d505c47d876f8076ca363797be2f5badd7
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Roaming\dwrn.exeFilesize
301KB
MD59b70f0dee9fa7de571b2c08a6f3a9a75
SHA1f3ad5f3cabe73c60c795c3367faaca682ddc1cc9
SHA256249b086fbb970eefa5bc4c9bcebcda1e8a638ed82a1bbf1a106cfe3807e3e121
SHA5122d47ea2d01e5643e5e5bec7e4b44e2c6cbc5c69f233bef27def943343403733a484baa58b90699f8ca29be52086750d505c47d876f8076ca363797be2f5badd7
-
memory/1220-60-0x0000000000000000-mapping.dmp
-
memory/1260-66-0x0000000000120000-0x0000000000170000-memory.dmpFilesize
320KB
-
memory/1260-63-0x0000000000000000-mapping.dmp
-
memory/1492-76-0x000000000040C75E-mapping.dmp
-
memory/1492-70-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-86-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-83-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-73-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-78-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-79-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-71-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1492-74-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1736-61-0x0000000000000000-mapping.dmp
-
memory/2016-57-0x00000000009B0000-0x00000000009B8000-memory.dmpFilesize
32KB
-
memory/2016-55-0x00000000003D0000-0x00000000003E6000-memory.dmpFilesize
88KB
-
memory/2016-59-0x00000000009E0000-0x00000000009E8000-memory.dmpFilesize
32KB
-
memory/2016-56-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/2016-54-0x0000000000C90000-0x0000000000CE0000-memory.dmpFilesize
320KB
-
memory/2016-58-0x00000000009C0000-0x00000000009C8000-memory.dmpFilesize
32KB