Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
Disposable Protective Mask.exe
Resource
win7-20220414-en
General
-
Target
Disposable Protective Mask.exe
-
Size
561KB
-
MD5
6f254eb4843ee683a0c43e340bfe8840
-
SHA1
82b24614b10237c4b8ab9b31a860555be00667b7
-
SHA256
82f23154db8360127ad3fbcab71948019b0e2904c1ec65d5045722f6ee91fdce
-
SHA512
2ed7a8a383366eefb4e2fe6d23f97f2ba24b992c315d6cdde6069e2e76910413a77c20b5da71ac74b35e8bfd05f36951225afbca8035b35a82d763d49ff65d19
Malware Config
Extracted
asyncrat
0.5.6D
TINOTINO
185.165.153.215:6606
uqeolevmck
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5044-138-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Disposable Protective Mask.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Disposable Protective Mask.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Disposable Protective Mask.exedescription pid process target process PID 2608 set thread context of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Disposable Protective Mask.exepid process 2608 Disposable Protective Mask.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Disposable Protective Mask.exedescription pid process Token: SeDebugPrivilege 2608 Disposable Protective Mask.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Disposable Protective Mask.exedescription pid process target process PID 2608 wrote to memory of 100 2608 Disposable Protective Mask.exe schtasks.exe PID 2608 wrote to memory of 100 2608 Disposable Protective Mask.exe schtasks.exe PID 2608 wrote to memory of 100 2608 Disposable Protective Mask.exe schtasks.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe PID 2608 wrote to memory of 5044 2608 Disposable Protective Mask.exe Disposable Protective Mask.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Disposable Protective Mask.exe"C:\Users\Admin\AppData\Local\Temp\Disposable Protective Mask.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vKnNDXnkQhbt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9252.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Disposable Protective Mask.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Disposable Protective Mask.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmp9252.tmpFilesize
1KB
MD5ab924e86dcdce6c93107610c1dfac1ab
SHA134a97b8dd987fa3e7e3436c2b034587373298f5d
SHA256142438b5ab714208ac82685df66de44c305ac626296daff795083f6a31918824
SHA51214926d7095ef60bab1ff84e117fa1546bc0422a105dff9b868926107739907334f8693f83d67282630d801bfb7486d556b29752c6f26824901a06bc8ff61e262
-
memory/100-135-0x0000000000000000-mapping.dmp
-
memory/2608-130-0x00000000002E0000-0x0000000000372000-memory.dmpFilesize
584KB
-
memory/2608-131-0x0000000009720000-0x0000000009CC4000-memory.dmpFilesize
5.6MB
-
memory/2608-132-0x0000000004E90000-0x0000000004F22000-memory.dmpFilesize
584KB
-
memory/2608-133-0x0000000004E00000-0x0000000004E0A000-memory.dmpFilesize
40KB
-
memory/2608-134-0x0000000009520000-0x00000000095BC000-memory.dmpFilesize
624KB
-
memory/5044-137-0x0000000000000000-mapping.dmp
-
memory/5044-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB