Overview
overview
10Static
static
2bbea59df3...7e.exe
windows7-x64
102bbea59df3...7e.exe
windows10-1703-x64
102bbea59df3...7e.exe
windows10-2004-x64
102bbea59df3...7e.exe
windows11-21h2-x64
2bbea59df3...7e.exe
android-10-x64
2bbea59df3...7e.exe
android-11-x64
2bbea59df3...7e.exe
android-9-x86
2bbea59df3...7e.exe
macos-10.15-amd64
12bbea59df3...7e.exe
debian-9-armhf
2bbea59df3...7e.exe
debian-9-mips
2bbea59df3...7e.exe
debian-9-mipsel
2bbea59df3...7e.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-08-2022 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
-
Size
2.2MB
-
MD5
b5f1a37cbd6c8a4690942fd254270ce1
-
SHA1
e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
-
SHA256
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
-
SHA512
6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
Malware Config
Extracted
asyncrat
0.5.7B
Default
76.8.53.133:62520
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
dwwm.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat behavioral1/memory/1908-66-0x00000000012B0000-0x00000000012C2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat behavioral1/memory/1712-88-0x0000000000D00000-0x0000000000D12000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Kxtwaidanpqpiuhprlehfsshclientip.exedwwm.exepid process 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe 1712 dwwm.exe -
Loads dropped DLL 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.execmd.exepid process 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1660 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Keahz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tbsztbbv\\Keahz.exe\"" 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\DBqQu = "C:\\Users\\Admin\\AppData\\Roaming\\DBqQu\\DBqQu.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription pid process target process PID 1512 set thread context of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1924 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exepid process 1756 powershell.exe 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1540 InstallUtil.exe 1540 InstallUtil.exe 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exepowershell.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exedwwm.exedescription pid process Token: SeDebugPrivilege 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 1540 InstallUtil.exe Token: SeDebugPrivilege 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe Token: SeDebugPrivilege 1712 dwwm.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.execmd.execmd.exedescription pid process target process PID 1512 wrote to memory of 1756 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1512 wrote to memory of 1756 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1512 wrote to memory of 1756 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1512 wrote to memory of 1756 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1512 wrote to memory of 1908 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1512 wrote to memory of 1908 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1512 wrote to memory of 1908 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1512 wrote to memory of 1908 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1512 wrote to memory of 1540 1512 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1908 wrote to memory of 1608 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1608 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1608 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1608 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1660 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1660 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1660 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1908 wrote to memory of 1660 1908 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1608 wrote to memory of 1648 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1648 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1648 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 1648 1608 cmd.exe schtasks.exe PID 1660 wrote to memory of 1924 1660 cmd.exe timeout.exe PID 1660 wrote to memory of 1924 1660 cmd.exe timeout.exe PID 1660 wrote to memory of 1924 1660 cmd.exe timeout.exe PID 1660 wrote to memory of 1924 1660 cmd.exe timeout.exe PID 1660 wrote to memory of 1712 1660 cmd.exe dwwm.exe PID 1660 wrote to memory of 1712 1660 cmd.exe dwwm.exe PID 1660 wrote to memory of 1712 1660 cmd.exe dwwm.exe PID 1660 wrote to memory of 1712 1660 cmd.exe dwwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAD12.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dwwm.exe"C:\Users\Admin\AppData\Roaming\dwwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\tmpAD12.tmp.batFilesize
148B
MD54ffacfcf93db36cd06de1fcdcdec370f
SHA137bbc2e8e44e856ea0b9a4ddaa1c504655fc433b
SHA2561e056ef5765fae65483d4d74faad9aab0525996d293737e245c1e166b0172fb1
SHA512ee7d2c71bccd6f9bb85e856704d5e4997cfbfb574f95731e4368052b36c1b2420ca7d6a95f3f928b46bbc6e8b985a9f1e604d5a82241fd5bb6b5358a642b5c1d
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
memory/1512-54-0x0000000000BF0000-0x0000000000E24000-memory.dmpFilesize
2.2MB
-
memory/1512-55-0x0000000004C10000-0x0000000004DF6000-memory.dmpFilesize
1.9MB
-
memory/1512-56-0x00000000006F0000-0x0000000000734000-memory.dmpFilesize
272KB
-
memory/1512-57-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1540-70-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-77-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-68-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-67-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-71-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-72-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1540-73-0x000000000047F6AE-mapping.dmp
-
memory/1540-75-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1608-79-0x0000000000000000-mapping.dmp
-
memory/1648-81-0x0000000000000000-mapping.dmp
-
memory/1660-80-0x0000000000000000-mapping.dmp
-
memory/1712-86-0x0000000000000000-mapping.dmp
-
memory/1712-88-0x0000000000D00000-0x0000000000D12000-memory.dmpFilesize
72KB
-
memory/1756-61-0x000000006F690000-0x000000006FC3B000-memory.dmpFilesize
5.7MB
-
memory/1756-60-0x000000006F690000-0x000000006FC3B000-memory.dmpFilesize
5.7MB
-
memory/1756-58-0x0000000000000000-mapping.dmp
-
memory/1908-66-0x00000000012B0000-0x00000000012C2000-memory.dmpFilesize
72KB
-
memory/1908-63-0x0000000000000000-mapping.dmp
-
memory/1924-83-0x0000000000000000-mapping.dmp