Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 22:35
Behavioral task
behavioral1
Sample
1660-55-0x0000000000380000-0x0000000000392000-memory.exe
Resource
win7-20220414-en
General
-
Target
1660-55-0x0000000000380000-0x0000000000392000-memory.exe
-
Size
72KB
-
MD5
9200c5f208c0740d4dcf96b1674d383e
-
SHA1
e26e185b70b71f2b320ba466f1e0a775d961ef61
-
SHA256
bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b
-
SHA512
276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
ncwfisdaribhhybik
-
delay
10
-
install
true
-
install_file
syastem.exe
-
install_folder
%AppData%
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1944-130-0x0000000000F60000-0x0000000000F72000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\syastem.exe asyncrat C:\Users\Admin\AppData\Roaming\syastem.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
syastem.exepid process 5044 syastem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1660-55-0x0000000000380000-0x0000000000392000-memory.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 1660-55-0x0000000000380000-0x0000000000392000-memory.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 548 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
1660-55-0x0000000000380000-0x0000000000392000-memory.exepid process 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1660-55-0x0000000000380000-0x0000000000392000-memory.exesyastem.exedescription pid process Token: SeDebugPrivilege 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe Token: SeDebugPrivilege 5044 syastem.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1660-55-0x0000000000380000-0x0000000000392000-memory.execmd.execmd.exedescription pid process target process PID 1944 wrote to memory of 3188 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe cmd.exe PID 1944 wrote to memory of 3188 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe cmd.exe PID 1944 wrote to memory of 3832 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe cmd.exe PID 1944 wrote to memory of 3832 1944 1660-55-0x0000000000380000-0x0000000000392000-memory.exe cmd.exe PID 3188 wrote to memory of 4896 3188 cmd.exe schtasks.exe PID 3188 wrote to memory of 4896 3188 cmd.exe schtasks.exe PID 3832 wrote to memory of 548 3832 cmd.exe timeout.exe PID 3832 wrote to memory of 548 3832 cmd.exe timeout.exe PID 3832 wrote to memory of 5044 3832 cmd.exe syastem.exe PID 3832 wrote to memory of 5044 3832 cmd.exe syastem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1660-55-0x0000000000380000-0x0000000000392000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1660-55-0x0000000000380000-0x0000000000392000-memory.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1660-55-0x0000000000380000-0x0000000000392000-memory /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 1660-55-0x0000000000380000-0x0000000000392000-memory /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp85EE.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\syastem.exe"C:\Users\Admin\AppData\Roaming\syastem.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp85EE.tmp.batFilesize
151B
MD57667fb0cfb2c0815adfd39a8fdcbfec3
SHA1b127057c4cac6d8285b69e3f82b42a516bc86bb5
SHA2560d2f3991e9fa9fdce0f19d8ff92927703e83b198a498ae03ce26f231d4bddff2
SHA512061dc0fe3b82582510252f9a2c91c85fb164ff3e94395193af481cfca0c739558fae8e823e979f882ea6af348f4108082821d83f0b1bb07c58a208663392e0f7
-
C:\Users\Admin\AppData\Roaming\syastem.exeFilesize
72KB
MD59200c5f208c0740d4dcf96b1674d383e
SHA1e26e185b70b71f2b320ba466f1e0a775d961ef61
SHA256bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b
SHA512276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396
-
C:\Users\Admin\AppData\Roaming\syastem.exeFilesize
72KB
MD59200c5f208c0740d4dcf96b1674d383e
SHA1e26e185b70b71f2b320ba466f1e0a775d961ef61
SHA256bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b
SHA512276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396
-
memory/548-138-0x0000000000000000-mapping.dmp
-
memory/1944-131-0x00007FFAB78F0000-0x00007FFAB83B1000-memory.dmpFilesize
10.8MB
-
memory/1944-132-0x00007FFAB78F0000-0x00007FFAB83B1000-memory.dmpFilesize
10.8MB
-
memory/1944-130-0x0000000000F60000-0x0000000000F72000-memory.dmpFilesize
72KB
-
memory/1944-136-0x00007FFAB78F0000-0x00007FFAB83B1000-memory.dmpFilesize
10.8MB
-
memory/3188-133-0x0000000000000000-mapping.dmp
-
memory/3832-134-0x0000000000000000-mapping.dmp
-
memory/4896-135-0x0000000000000000-mapping.dmp
-
memory/5044-139-0x0000000000000000-mapping.dmp
-
memory/5044-142-0x00007FFAB78F0000-0x00007FFAB83B1000-memory.dmpFilesize
10.8MB
-
memory/5044-143-0x00007FFAB78F0000-0x00007FFAB83B1000-memory.dmpFilesize
10.8MB