Analysis
-
max time kernel
42s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 21:52
Behavioral task
behavioral1
Sample
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe
Resource
win7-20220414-en
General
-
Target
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe
-
Size
48KB
-
MD5
747973b0b920bcace8ebf382a3edd701
-
SHA1
6923e0e2e6b5813578142446fd48744bef443f67
-
SHA256
016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
-
SHA512
814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
Malware Config
Extracted
asyncrat
0.5.7B
Default
spk.accesscam.org:55555
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
google.exe
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/656-54-0x0000000000EB0000-0x0000000000EC2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\google.exe asyncrat behavioral1/memory/2028-65-0x00000000001B0000-0x00000000001C2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\google.exe asyncrat \Users\Admin\AppData\Roaming\google.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
google.exepid process 2028 google.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 948 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1808 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exepid process 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exegoogle.exedescription pid process Token: SeDebugPrivilege 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe Token: SeDebugPrivilege 2028 google.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.execmd.execmd.exedescription pid process target process PID 656 wrote to memory of 1392 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 1392 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 1392 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 1392 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 948 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 948 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 948 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 656 wrote to memory of 948 656 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 1392 wrote to memory of 1120 1392 cmd.exe schtasks.exe PID 1392 wrote to memory of 1120 1392 cmd.exe schtasks.exe PID 1392 wrote to memory of 1120 1392 cmd.exe schtasks.exe PID 1392 wrote to memory of 1120 1392 cmd.exe schtasks.exe PID 948 wrote to memory of 1808 948 cmd.exe timeout.exe PID 948 wrote to memory of 1808 948 cmd.exe timeout.exe PID 948 wrote to memory of 1808 948 cmd.exe timeout.exe PID 948 wrote to memory of 1808 948 cmd.exe timeout.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe PID 948 wrote to memory of 2028 948 cmd.exe google.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe"C:\Users\Admin\AppData\Local\Temp\016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp257C.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\google.exe"C:\Users\Admin\AppData\Roaming\google.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "google" /tr '"C:\Users\Admin\AppData\Roaming\google.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "google" /tr '"C:\Users\Admin\AppData\Roaming\google.exe"'1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp257C.tmp.batFilesize
150B
MD5c82857a131e72bcf0a66fabcf861e05e
SHA112fa0a98be7d5f3843912b67ce7d3a2aa0510c46
SHA256a0f73f8f8f0031f662e3860bf53435449f072f1742b40a08925fe650cd953581
SHA51219a4fab3e7d612c33caefda064b0e14b148ae0d535e298e627d44de60b31a3e3532df2be9a257c4e1fea33a9a098910016147d7910dd0f3abeda3438c485d33b
-
C:\Users\Admin\AppData\Roaming\google.exeFilesize
48KB
MD5747973b0b920bcace8ebf382a3edd701
SHA16923e0e2e6b5813578142446fd48744bef443f67
SHA256016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
SHA512814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
-
C:\Users\Admin\AppData\Roaming\google.exeFilesize
48KB
MD5747973b0b920bcace8ebf382a3edd701
SHA16923e0e2e6b5813578142446fd48744bef443f67
SHA256016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
SHA512814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
-
\Users\Admin\AppData\Roaming\google.exeFilesize
48KB
MD5747973b0b920bcace8ebf382a3edd701
SHA16923e0e2e6b5813578142446fd48744bef443f67
SHA256016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
SHA512814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
-
memory/656-54-0x0000000000EB0000-0x0000000000EC2000-memory.dmpFilesize
72KB
-
memory/656-55-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/948-57-0x0000000000000000-mapping.dmp
-
memory/1120-59-0x0000000000000000-mapping.dmp
-
memory/1392-56-0x0000000000000000-mapping.dmp
-
memory/1808-60-0x0000000000000000-mapping.dmp
-
memory/2028-63-0x0000000000000000-mapping.dmp
-
memory/2028-65-0x00000000001B0000-0x00000000001C2000-memory.dmpFilesize
72KB