Overview
overview
10Static
static
2bbea59df3...7e.exe
windows7-x64
102bbea59df3...7e.exe
windows10-1703-x64
102bbea59df3...7e.exe
windows10-2004-x64
102bbea59df3...7e.exe
windows11-21h2-x64
2bbea59df3...7e.exe
android-10-x64
2bbea59df3...7e.exe
android-11-x64
2bbea59df3...7e.exe
android-9-x86
2bbea59df3...7e.exe
macos-10.15-amd64
12bbea59df3...7e.exe
debian-9-armhf
2bbea59df3...7e.exe
debian-9-mips
2bbea59df3...7e.exe
debian-9-mipsel
2bbea59df3...7e.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
157s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2022 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
-
Size
2.2MB
-
MD5
b5f1a37cbd6c8a4690942fd254270ce1
-
SHA1
e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
-
SHA256
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
-
SHA512
6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
Malware Config
Extracted
asyncrat
0.5.7B
Default
76.8.53.133:62520
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
dwwm.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat behavioral3/memory/4760-145-0x00000000006D0000-0x00000000006E2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Kxtwaidanpqpiuhprlehfsshclientip.exedwwm.exepid process 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4676 dwwm.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Kxtwaidanpqpiuhprlehfsshclientip.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
InstallUtil.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DBqQu = "C:\\Users\\Admin\\AppData\\Roaming\\DBqQu\\DBqQu.exe" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Keahz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tbsztbbv\\Keahz.exe\"" 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription pid process target process PID 4956 set thread context of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4680 timeout.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
powershell.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exepid process 1408 powershell.exe 1408 powershell.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 3368 InstallUtil.exe 3368 InstallUtil.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exepowershell.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exedwwm.exedescription pid process Token: SeDebugPrivilege 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeDebugPrivilege 3368 InstallUtil.exe Token: SeDebugPrivilege 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe Token: SeDebugPrivilege 4676 dwwm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3368 InstallUtil.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.execmd.execmd.exedescription pid process target process PID 4956 wrote to memory of 1408 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 4956 wrote to memory of 1408 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 4956 wrote to memory of 1408 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 4956 wrote to memory of 4760 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 4956 wrote to memory of 4760 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 4956 wrote to memory of 4760 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 4956 wrote to memory of 1860 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 1860 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 1860 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4956 wrote to memory of 3368 4956 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 4760 wrote to memory of 808 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4760 wrote to memory of 808 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4760 wrote to memory of 808 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4760 wrote to memory of 3588 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4760 wrote to memory of 3588 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4760 wrote to memory of 3588 4760 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 808 wrote to memory of 2728 808 cmd.exe schtasks.exe PID 808 wrote to memory of 2728 808 cmd.exe schtasks.exe PID 808 wrote to memory of 2728 808 cmd.exe schtasks.exe PID 3588 wrote to memory of 4680 3588 cmd.exe timeout.exe PID 3588 wrote to memory of 4680 3588 cmd.exe timeout.exe PID 3588 wrote to memory of 4680 3588 cmd.exe timeout.exe PID 3588 wrote to memory of 4676 3588 cmd.exe dwwm.exe PID 3588 wrote to memory of 4676 3588 cmd.exe dwwm.exe PID 3588 wrote to memory of 4676 3588 cmd.exe dwwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF467.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dwwm.exe"C:\Users\Admin\AppData\Roaming\dwwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\tmpF467.tmp.batFilesize
148B
MD5977d188f1f3393150ad1d632cbefa8a3
SHA1981eb6333093025487fd7d44acda8c1bfb3e7619
SHA256557d6298c9d4d116e0fe395365089d5db698a49cd12c6cdbb919d808cb9dfe48
SHA51245079613341455bdcc2982f2d798aa1c5091c59b203dc463767b3645a539fd190f8ab53b927df4992f5d3df27cf64cc7313e0f8ac90df3e3b735721f36228270
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
memory/808-152-0x0000000000000000-mapping.dmp
-
memory/1408-138-0x0000000006100000-0x0000000006166000-memory.dmpFilesize
408KB
-
memory/1408-139-0x0000000006920000-0x000000000693E000-memory.dmpFilesize
120KB
-
memory/1408-140-0x0000000008180000-0x00000000087FA000-memory.dmpFilesize
6.5MB
-
memory/1408-141-0x0000000006E20000-0x0000000006E3A000-memory.dmpFilesize
104KB
-
memory/1408-137-0x0000000006090000-0x00000000060F6000-memory.dmpFilesize
408KB
-
memory/1408-136-0x00000000059F0000-0x0000000006018000-memory.dmpFilesize
6.2MB
-
memory/1408-135-0x0000000005360000-0x0000000005396000-memory.dmpFilesize
216KB
-
memory/1408-134-0x0000000000000000-mapping.dmp
-
memory/1860-146-0x0000000000000000-mapping.dmp
-
memory/2728-155-0x0000000000000000-mapping.dmp
-
memory/3368-147-0x0000000000000000-mapping.dmp
-
memory/3368-148-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/3368-149-0x00000000056F0000-0x0000000005C94000-memory.dmpFilesize
5.6MB
-
memory/3368-150-0x00000000051E0000-0x0000000005272000-memory.dmpFilesize
584KB
-
memory/3368-160-0x0000000006020000-0x000000000602A000-memory.dmpFilesize
40KB
-
memory/3588-153-0x0000000000000000-mapping.dmp
-
memory/4676-157-0x0000000000000000-mapping.dmp
-
memory/4680-156-0x0000000000000000-mapping.dmp
-
memory/4760-145-0x00000000006D0000-0x00000000006E2000-memory.dmpFilesize
72KB
-
memory/4760-142-0x0000000000000000-mapping.dmp
-
memory/4760-151-0x0000000005060000-0x00000000050FC000-memory.dmpFilesize
624KB
-
memory/4956-132-0x0000000000ED0000-0x0000000001104000-memory.dmpFilesize
2.2MB
-
memory/4956-133-0x0000000005D20000-0x0000000005D42000-memory.dmpFilesize
136KB