Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 22:32
Static task
static1
Behavioral task
behavioral1
Sample
A4A60422374845BF0ABD892DD48D352978D697C883196.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
A4A60422374845BF0ABD892DD48D352978D697C883196.exe
Resource
win10v2004-20220414-en
General
-
Target
A4A60422374845BF0ABD892DD48D352978D697C883196.exe
-
Size
701KB
-
MD5
1bd98c5b4581aeff9b65ce5653f49cdf
-
SHA1
3091d81da54ed79391b456e8e94e6b939be2a316
-
SHA256
a4a60422374845bf0abd892dd48d352978d697c883196392e0d692f70f0e85c1
-
SHA512
f1462a6d7cfc813cd2ba05d6ccac9656b76ef4ea7418992d1b3b1acdbd779d7b2ab016322f30264c123fea92114a481c1400dc965964731c86974b98922486cc
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Executes dropped EXE 1 IoCs
Processes:
syastem.exepid process 2388 syastem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
A4A60422374845BF0ABD892DD48D352978D697C883196.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation A4A60422374845BF0ABD892DD48D352978D697C883196.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2224 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
A4A60422374845BF0ABD892DD48D352978D697C883196.exepid process 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
A4A60422374845BF0ABD892DD48D352978D697C883196.exesyastem.exedescription pid process Token: SeDebugPrivilege 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe Token: SeDebugPrivilege 2388 syastem.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
A4A60422374845BF0ABD892DD48D352978D697C883196.execmd.execmd.exedescription pid process target process PID 4588 wrote to memory of 1164 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 4588 wrote to memory of 1164 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 4588 wrote to memory of 1164 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 4588 wrote to memory of 3768 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 4588 wrote to memory of 3768 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 4588 wrote to memory of 3768 4588 A4A60422374845BF0ABD892DD48D352978D697C883196.exe cmd.exe PID 1164 wrote to memory of 2752 1164 cmd.exe schtasks.exe PID 1164 wrote to memory of 2752 1164 cmd.exe schtasks.exe PID 1164 wrote to memory of 2752 1164 cmd.exe schtasks.exe PID 3768 wrote to memory of 2224 3768 cmd.exe timeout.exe PID 3768 wrote to memory of 2224 3768 cmd.exe timeout.exe PID 3768 wrote to memory of 2224 3768 cmd.exe timeout.exe PID 3768 wrote to memory of 2388 3768 cmd.exe syastem.exe PID 3768 wrote to memory of 2388 3768 cmd.exe syastem.exe PID 3768 wrote to memory of 2388 3768 cmd.exe syastem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\A4A60422374845BF0ABD892DD48D352978D697C883196.exe"C:\Users\Admin\AppData\Local\Temp\A4A60422374845BF0ABD892DD48D352978D697C883196.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn A4A60422374845BF0ABD892DD48D352978D697C883196 /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn A4A60422374845BF0ABD892DD48D352978D697C883196 /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1CEE.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\syastem.exe"C:\Users\Admin\AppData\Roaming\syastem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1CEE.tmp.batFilesize
151B
MD550fad9c0514fb99c3d99fc3879d2160a
SHA17d2db9a732f4a9218b2ba0d67e94384e5f57a42e
SHA25614727941378afdb4263516a7b35c8a592bb70e10fff9aa0f9bd35c40a4a8c7ff
SHA51281a5a0691b421510232f49a2fb63fd5c5c1fcaaacbacdc88b2ee1158a36715ca983a019608ee9b42c99383b46098cce2678f885fa662e431009f6357b1e9590e
-
C:\Users\Admin\AppData\Roaming\syastem.exeFilesize
701KB
MD51bd98c5b4581aeff9b65ce5653f49cdf
SHA13091d81da54ed79391b456e8e94e6b939be2a316
SHA256a4a60422374845bf0abd892dd48d352978d697c883196392e0d692f70f0e85c1
SHA512f1462a6d7cfc813cd2ba05d6ccac9656b76ef4ea7418992d1b3b1acdbd779d7b2ab016322f30264c123fea92114a481c1400dc965964731c86974b98922486cc
-
C:\Users\Admin\AppData\Roaming\syastem.exeFilesize
701KB
MD51bd98c5b4581aeff9b65ce5653f49cdf
SHA13091d81da54ed79391b456e8e94e6b939be2a316
SHA256a4a60422374845bf0abd892dd48d352978d697c883196392e0d692f70f0e85c1
SHA512f1462a6d7cfc813cd2ba05d6ccac9656b76ef4ea7418992d1b3b1acdbd779d7b2ab016322f30264c123fea92114a481c1400dc965964731c86974b98922486cc
-
memory/1164-134-0x0000000000000000-mapping.dmp
-
memory/2224-138-0x0000000000000000-mapping.dmp
-
memory/2388-139-0x0000000000000000-mapping.dmp
-
memory/2388-142-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/2752-137-0x0000000000000000-mapping.dmp
-
memory/3768-135-0x0000000000000000-mapping.dmp
-
memory/4588-133-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/4588-130-0x0000000000910000-0x00000000009C4000-memory.dmpFilesize
720KB
-
memory/4588-132-0x0000000005A70000-0x0000000006014000-memory.dmpFilesize
5.6MB
-
memory/4588-131-0x0000000005420000-0x00000000054BC000-memory.dmpFilesize
624KB