Analysis
-
max time kernel
156s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:19
Behavioral task
behavioral1
Sample
NEW AUGUST PO no645678.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
NEW AUGUST PO no645678.exe
Resource
win10v2004-20220414-en
General
-
Target
NEW AUGUST PO no645678.exe
-
Size
156KB
-
MD5
305f2747892b5f6d71320299e5c0c577
-
SHA1
187f9a3d1c59de18b76f17a533adbf2cc23e8cae
-
SHA256
423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
-
SHA512
1ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
Malware Config
Extracted
asyncrat
0.5.6A
5
79.134.225.85:1515
kurtbloomberg.ddns.net:1515
chsxzzvrmtz
-
delay
0
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3564-130-0x0000000000980000-0x00000000009AE000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe asyncrat C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe asyncrat behavioral2/memory/460-139-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
abobex.exeInstallUtil.exepid process 4204 abobex.exe 460 InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEW AUGUST PO no645678.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation NEW AUGUST PO no645678.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\abobex = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\abobex.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
abobex.exedescription pid process target process PID 4204 set thread context of 460 4204 abobex.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
NEW AUGUST PO no645678.exeabobex.exeInstallUtil.exepid process 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 3564 NEW AUGUST PO no645678.exe 4204 abobex.exe 4204 abobex.exe 4204 abobex.exe 460 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NEW AUGUST PO no645678.exeabobex.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3564 NEW AUGUST PO no645678.exe Token: SeDebugPrivilege 4204 abobex.exe Token: SeDebugPrivilege 460 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
NEW AUGUST PO no645678.execmd.exeabobex.exedescription pid process target process PID 3564 wrote to memory of 4380 3564 NEW AUGUST PO no645678.exe cmd.exe PID 3564 wrote to memory of 4380 3564 NEW AUGUST PO no645678.exe cmd.exe PID 3564 wrote to memory of 4380 3564 NEW AUGUST PO no645678.exe cmd.exe PID 4380 wrote to memory of 3560 4380 cmd.exe reg.exe PID 4380 wrote to memory of 3560 4380 cmd.exe reg.exe PID 4380 wrote to memory of 3560 4380 cmd.exe reg.exe PID 3564 wrote to memory of 4204 3564 NEW AUGUST PO no645678.exe abobex.exe PID 3564 wrote to memory of 4204 3564 NEW AUGUST PO no645678.exe abobex.exe PID 3564 wrote to memory of 4204 3564 NEW AUGUST PO no645678.exe abobex.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe PID 4204 wrote to memory of 460 4204 abobex.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW AUGUST PO no645678.exe"C:\Users\Admin\AppData\Local\Temp\NEW AUGUST PO no645678.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v abobex /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v abobex /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exeFilesize
156KB
MD5305f2747892b5f6d71320299e5c0c577
SHA1187f9a3d1c59de18b76f17a533adbf2cc23e8cae
SHA256423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
SHA5121ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\abobex.exeFilesize
156KB
MD5305f2747892b5f6d71320299e5c0c577
SHA1187f9a3d1c59de18b76f17a533adbf2cc23e8cae
SHA256423654743684a77ccf595dc264bdf6dc6a0b61507d1743f25f7a4e32ce1e13dc
SHA5121ff3bca50fed788224c0826270c1f0c760e1ba3f65f255c1110760f033180ba9558616a91c638fd10c8605e17cf140a6b98392a8988978c1d866cf29b20a5799
-
memory/460-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/460-138-0x0000000000000000-mapping.dmp
-
memory/460-142-0x0000000005780000-0x00000000057E6000-memory.dmpFilesize
408KB
-
memory/3560-134-0x0000000000000000-mapping.dmp
-
memory/3564-130-0x0000000000980000-0x00000000009AE000-memory.dmpFilesize
184KB
-
memory/3564-132-0x0000000005C50000-0x0000000005CE2000-memory.dmpFilesize
584KB
-
memory/3564-131-0x0000000006120000-0x00000000066C4000-memory.dmpFilesize
5.6MB
-
memory/4204-135-0x0000000000000000-mapping.dmp
-
memory/4380-133-0x0000000000000000-mapping.dmp