Analysis
-
max time kernel
16s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 21:52
Behavioral task
behavioral1
Sample
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe
Resource
win7-20220414-en
General
-
Target
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe
-
Size
48KB
-
MD5
747973b0b920bcace8ebf382a3edd701
-
SHA1
6923e0e2e6b5813578142446fd48744bef443f67
-
SHA256
016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
-
SHA512
814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
Malware Config
Extracted
asyncrat
0.5.7B
Default
spk.accesscam.org:55555
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
google.exe
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/944-130-0x0000000000180000-0x0000000000192000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\google.exe asyncrat C:\Users\Admin\AppData\Roaming\google.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
google.exepid process 3596 google.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5028 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exepid process 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exegoogle.exedescription pid process Token: SeDebugPrivilege 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe Token: SeDebugPrivilege 3596 google.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.execmd.execmd.exedescription pid process target process PID 944 wrote to memory of 4676 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 944 wrote to memory of 4676 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 944 wrote to memory of 4676 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 944 wrote to memory of 3932 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 944 wrote to memory of 3932 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 944 wrote to memory of 3932 944 016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe cmd.exe PID 4676 wrote to memory of 3656 4676 cmd.exe schtasks.exe PID 4676 wrote to memory of 3656 4676 cmd.exe schtasks.exe PID 4676 wrote to memory of 3656 4676 cmd.exe schtasks.exe PID 3932 wrote to memory of 5028 3932 cmd.exe timeout.exe PID 3932 wrote to memory of 5028 3932 cmd.exe timeout.exe PID 3932 wrote to memory of 5028 3932 cmd.exe timeout.exe PID 3932 wrote to memory of 3596 3932 cmd.exe google.exe PID 3932 wrote to memory of 3596 3932 cmd.exe google.exe PID 3932 wrote to memory of 3596 3932 cmd.exe google.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe"C:\Users\Admin\AppData\Local\Temp\016D808DD3D45A17F7230BFE8DF690D2B75C18BD93F44.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp75C1.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\google.exe"C:\Users\Admin\AppData\Roaming\google.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "google" /tr '"C:\Users\Admin\AppData\Roaming\google.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "google" /tr '"C:\Users\Admin\AppData\Roaming\google.exe"'1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp75C1.tmp.batFilesize
150B
MD52632d119f536f1ed2c87c45a13d9ac22
SHA1c784d62197640fb9761f01d41e3506955201f9ed
SHA256820a20c5f1ef12fcc38f0c820fa56d199ba5b38b8b4d046fd1da8e529e388a0e
SHA5121cd00386ffd29b9f45ef5b3ac58710cd3a3d79ed8dd5cc5a36f5ec09d1497191c2cd3e2fd0205501f12b0a2721a9ccc973d4201528a84f2bbda59d62d109f056
-
C:\Users\Admin\AppData\Roaming\google.exeFilesize
48KB
MD5747973b0b920bcace8ebf382a3edd701
SHA16923e0e2e6b5813578142446fd48744bef443f67
SHA256016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
SHA512814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
-
C:\Users\Admin\AppData\Roaming\google.exeFilesize
48KB
MD5747973b0b920bcace8ebf382a3edd701
SHA16923e0e2e6b5813578142446fd48744bef443f67
SHA256016d808dd3d45a17f7230bfe8df690d2b75c18bd93f44f60badf12924f4266b0
SHA512814c0a9787a2012ae3c61a1c43c9cc68bd50b3bd3fed634003d6274c93f987abcea79e41e12caea61658ffab7b69f3b76934a69e9eda8d96ca325e9b83c71c27
-
memory/944-130-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/944-131-0x0000000004B40000-0x0000000004BDC000-memory.dmpFilesize
624KB
-
memory/3596-137-0x0000000000000000-mapping.dmp
-
memory/3596-140-0x0000000005C80000-0x0000000006224000-memory.dmpFilesize
5.6MB
-
memory/3596-141-0x00000000057A0000-0x0000000005806000-memory.dmpFilesize
408KB
-
memory/3656-135-0x0000000000000000-mapping.dmp
-
memory/3932-133-0x0000000000000000-mapping.dmp
-
memory/4676-132-0x0000000000000000-mapping.dmp
-
memory/5028-136-0x0000000000000000-mapping.dmp