Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
Transferencias Copiar.jar
Resource
win7-20220414-en
General
-
Target
Transferencias Copiar.jar
-
Size
287KB
-
MD5
513cc3544b4a0523218326b30e99b46b
-
SHA1
0927ad5ab4a30014fe0125793729ca9f8a74d95a
-
SHA256
d021841d4a25bbe872ac7f71427e5731e441a9f6150f6ebb208c664d6ba48acd
-
SHA512
fe435151e2d374858426777b95c18fb5590ab745815a43e58ad6ae4d6c19610895750d6cebcfc7341cedf6b3ed78c46db06b8d2b74ba889618a54222326a7ecf
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral1/memory/1388-87-0x00000000001C0000-0x00000000001D2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat behavioral1/memory/1296-102-0x0000000001080000-0x0000000001092000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 1388 AsyncClient.exe 1296 win.exe -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\arkhamqi.txt java.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 920 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\arkhamqi = "\"C:\\Users\\Admin\\AppData\\Roaming\\arkhamqi.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arkhamqi = "\"C:\\Users\\Admin\\AppData\\Roaming\\arkhamqi.txt\"" java.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1484 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 1388 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 1388 AsyncClient.exe Token: SeDebugPrivilege 1296 win.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
java.exewscript.exeWScript.exeAsyncClient.execmd.execmd.exejavaw.exejava.execmd.exedescription pid process target process PID 1948 wrote to memory of 1040 1948 java.exe wscript.exe PID 1948 wrote to memory of 1040 1948 java.exe wscript.exe PID 1948 wrote to memory of 1040 1948 java.exe wscript.exe PID 1040 wrote to memory of 860 1040 wscript.exe WScript.exe PID 1040 wrote to memory of 860 1040 wscript.exe WScript.exe PID 1040 wrote to memory of 860 1040 wscript.exe WScript.exe PID 1040 wrote to memory of 1056 1040 wscript.exe javaw.exe PID 1040 wrote to memory of 1056 1040 wscript.exe javaw.exe PID 1040 wrote to memory of 1056 1040 wscript.exe javaw.exe PID 860 wrote to memory of 1388 860 WScript.exe AsyncClient.exe PID 860 wrote to memory of 1388 860 WScript.exe AsyncClient.exe PID 860 wrote to memory of 1388 860 WScript.exe AsyncClient.exe PID 860 wrote to memory of 1388 860 WScript.exe AsyncClient.exe PID 1388 wrote to memory of 972 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 972 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 972 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 972 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 920 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 920 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 920 1388 AsyncClient.exe cmd.exe PID 1388 wrote to memory of 920 1388 AsyncClient.exe cmd.exe PID 972 wrote to memory of 1112 972 cmd.exe schtasks.exe PID 972 wrote to memory of 1112 972 cmd.exe schtasks.exe PID 972 wrote to memory of 1112 972 cmd.exe schtasks.exe PID 972 wrote to memory of 1112 972 cmd.exe schtasks.exe PID 920 wrote to memory of 1484 920 cmd.exe timeout.exe PID 920 wrote to memory of 1484 920 cmd.exe timeout.exe PID 920 wrote to memory of 1484 920 cmd.exe timeout.exe PID 920 wrote to memory of 1484 920 cmd.exe timeout.exe PID 920 wrote to memory of 1296 920 cmd.exe win.exe PID 920 wrote to memory of 1296 920 cmd.exe win.exe PID 920 wrote to memory of 1296 920 cmd.exe win.exe PID 920 wrote to memory of 1296 920 cmd.exe win.exe PID 1056 wrote to memory of 2044 1056 javaw.exe java.exe PID 1056 wrote to memory of 2044 1056 javaw.exe java.exe PID 1056 wrote to memory of 2044 1056 javaw.exe java.exe PID 2044 wrote to memory of 2036 2044 java.exe cmd.exe PID 2044 wrote to memory of 2036 2044 java.exe cmd.exe PID 2044 wrote to memory of 2036 2044 java.exe cmd.exe PID 2044 wrote to memory of 1356 2044 java.exe java.exe PID 2044 wrote to memory of 1356 2044 java.exe java.exe PID 2044 wrote to memory of 1356 2044 java.exe java.exe PID 2036 wrote to memory of 240 2036 cmd.exe schtasks.exe PID 2036 wrote to memory of 240 2036 cmd.exe schtasks.exe PID 2036 wrote to memory of 240 2036 cmd.exe schtasks.exe
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Transferencias Copiar.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript C:\Users\Admin\mjjrsmctby.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\dHqmoqeAFb.js"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBC4E.tmp.bat""5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\arkhamqi.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\arkhamqi.txt"4⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\arkhamqi.txt"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\arkhamqi.txt"6⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\arkhamqi.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBC4E.tmp.batFilesize
147B
MD5640985918c7a7538a155c072534da02a
SHA1d24f2ba45d617ee1d5f5f73f25cd0569345bfe60
SHA25695a9bd9cb9fb426996505f2a9078f5b65ac54096c6fbbfccab6f04b3e9158013
SHA51274af364b8aa40c84ce1757bfaa50e1d2cf9e9a638e0a4db3d79eb196e6638d49cdac5b36ca9ab9aac175f458b29d0726f732a35f6331d00e04bf7eb8a5b82f59
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\arkhamqi.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
C:\Users\Admin\AppData\Roaming\arkhamqi.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
C:\Users\Admin\AppData\Roaming\dHqmoqeAFb.jsFilesize
88KB
MD510431f8891bb9c5109b16fa0b113c3d5
SHA1d88238c36eaf99364cb4839e16c2c50162e906c1
SHA256726f9c6ad061a7f316ecfff034ef9e1916443d64d79007435a1e1bf101958994
SHA512b3376e7f7d82125e031bc9a3f1b7a74add2591b5b6f8a1e3084775793fa548b20c1629e39b2a6b750eeac3cab668f0acd41671320e025e0c26c573d5ce63924e
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\arkhamqi.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
C:\Users\Admin\lib\jna-5.5.0.jarFilesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\lib\jna-platform-5.5.0.jarFilesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jarFilesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\lib\system-hook-3.5.jarFilesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
C:\Users\Admin\mjjrsmctby.jsFilesize
480KB
MD5db0c97c4781ea7c7f09de49fc0d7aa6b
SHA1f36740c3b50cd17e7d679fd5386eb60e2505288e
SHA256a58951a7f9087e40b330ee667c84fc12e884ad609c60450fd6a34e4db16ea559
SHA5126f00a0ec3df2dd6ee0c501d5617b9237cf689753ec06003305ec7f097b9be01bfce86bff949eaab9cdd45e6edaceb37aff1cf3b0dbeeb30b61c04b2f3d7f7349
-
\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/240-123-0x0000000000000000-mapping.dmp
-
memory/860-69-0x0000000000000000-mapping.dmp
-
memory/920-91-0x0000000000000000-mapping.dmp
-
memory/972-90-0x0000000000000000-mapping.dmp
-
memory/1040-65-0x0000000000000000-mapping.dmp
-
memory/1056-72-0x0000000000000000-mapping.dmp
-
memory/1056-88-0x0000000002230000-0x0000000005230000-memory.dmpFilesize
48.0MB
-
memory/1112-92-0x0000000000000000-mapping.dmp
-
memory/1296-100-0x0000000000000000-mapping.dmp
-
memory/1296-102-0x0000000001080000-0x0000000001092000-memory.dmpFilesize
72KB
-
memory/1356-136-0x0000000002260000-0x0000000005260000-memory.dmpFilesize
48.0MB
-
memory/1356-131-0x0000000002260000-0x0000000005260000-memory.dmpFilesize
48.0MB
-
memory/1356-122-0x0000000000000000-mapping.dmp
-
memory/1388-89-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/1388-74-0x0000000000000000-mapping.dmp
-
memory/1388-87-0x00000000001C0000-0x00000000001D2000-memory.dmpFilesize
72KB
-
memory/1484-94-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmpFilesize
8KB
-
memory/1948-61-0x0000000002080000-0x0000000005080000-memory.dmpFilesize
48.0MB
-
memory/2036-121-0x0000000000000000-mapping.dmp
-
memory/2044-113-0x00000000020B0000-0x00000000050B0000-memory.dmpFilesize
48.0MB
-
memory/2044-103-0x0000000000000000-mapping.dmp