Overview
overview
10Static
static
2bbea59df3...7e.exe
windows7-x64
102bbea59df3...7e.exe
windows10-1703-x64
102bbea59df3...7e.exe
windows10-2004-x64
102bbea59df3...7e.exe
windows11-21h2-x64
2bbea59df3...7e.exe
android-10-x64
2bbea59df3...7e.exe
android-11-x64
2bbea59df3...7e.exe
android-9-x86
2bbea59df3...7e.exe
macos-10.15-amd64
12bbea59df3...7e.exe
debian-9-armhf
2bbea59df3...7e.exe
debian-9-mips
2bbea59df3...7e.exe
debian-9-mipsel
2bbea59df3...7e.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-08-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
-
Size
2.2MB
-
MD5
b5f1a37cbd6c8a4690942fd254270ce1
-
SHA1
e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
-
SHA256
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
-
SHA512
6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
Malware Config
Extracted
asyncrat
0.5.7B
Default
76.8.53.133:62520
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
dwwm.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat behavioral1/memory/1932-67-0x0000000000300000-0x0000000000312000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat behavioral1/memory/1988-89-0x0000000000D40000-0x0000000000D52000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Kxtwaidanpqpiuhprlehfsshclientip.exedwwm.exepid process 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe 1988 dwwm.exe -
Loads dropped DLL 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.execmd.exepid process 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1212 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Keahz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tbsztbbv\\Keahz.exe\"" 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\DBqQu = "C:\\Users\\Admin\\AppData\\Roaming\\DBqQu\\DBqQu.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription pid process target process PID 364 set thread context of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1980 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exepid process 912 powershell.exe 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1776 InstallUtil.exe 1776 InstallUtil.exe 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exepowershell.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exedwwm.exedescription pid process Token: SeDebugPrivilege 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Token: SeDebugPrivilege 912 powershell.exe Token: SeDebugPrivilege 1776 InstallUtil.exe Token: SeDebugPrivilege 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe Token: SeDebugPrivilege 1988 dwwm.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.execmd.execmd.exedescription pid process target process PID 364 wrote to memory of 912 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 364 wrote to memory of 912 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 364 wrote to memory of 912 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 364 wrote to memory of 912 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 364 wrote to memory of 1932 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 364 wrote to memory of 1932 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 364 wrote to memory of 1932 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 364 wrote to memory of 1932 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 364 wrote to memory of 1776 364 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1932 wrote to memory of 288 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 288 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 288 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 288 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 1212 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 1212 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 1212 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1932 wrote to memory of 1212 1932 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 288 wrote to memory of 1732 288 cmd.exe schtasks.exe PID 288 wrote to memory of 1732 288 cmd.exe schtasks.exe PID 288 wrote to memory of 1732 288 cmd.exe schtasks.exe PID 288 wrote to memory of 1732 288 cmd.exe schtasks.exe PID 1212 wrote to memory of 1980 1212 cmd.exe timeout.exe PID 1212 wrote to memory of 1980 1212 cmd.exe timeout.exe PID 1212 wrote to memory of 1980 1212 cmd.exe timeout.exe PID 1212 wrote to memory of 1980 1212 cmd.exe timeout.exe PID 1212 wrote to memory of 1988 1212 cmd.exe dwwm.exe PID 1212 wrote to memory of 1988 1212 cmd.exe dwwm.exe PID 1212 wrote to memory of 1988 1212 cmd.exe dwwm.exe PID 1212 wrote to memory of 1988 1212 cmd.exe dwwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3C37.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dwwm.exe"C:\Users\Admin\AppData\Roaming\dwwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\tmp3C37.tmp.batFilesize
148B
MD5f6b64a472b0d9d46003d61fd65d345b7
SHA1a2214be1db6c49378fba5a98e88fa960ba1c7b4c
SHA256fc2b468c027944e175a182e43675f155d6e9a6da2b2605c6e34b34069b920670
SHA512c1ebea97fae33b3ce010cadc72384492558006f507d34edab3c88fdedf9f4c624095b3d183f77afafd1770bb7da9af63f18842213c89085b851b281b99bea8bf
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
memory/288-80-0x0000000000000000-mapping.dmp
-
memory/364-55-0x0000000004D00000-0x0000000004EE6000-memory.dmpFilesize
1.9MB
-
memory/364-56-0x0000000000720000-0x0000000000764000-memory.dmpFilesize
272KB
-
memory/364-57-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/364-54-0x00000000013E0000-0x0000000001614000-memory.dmpFilesize
2.2MB
-
memory/912-62-0x000000006F920000-0x000000006FECB000-memory.dmpFilesize
5.7MB
-
memory/912-60-0x000000006F920000-0x000000006FECB000-memory.dmpFilesize
5.7MB
-
memory/912-61-0x000000006F920000-0x000000006FECB000-memory.dmpFilesize
5.7MB
-
memory/912-58-0x0000000000000000-mapping.dmp
-
memory/1212-81-0x0000000000000000-mapping.dmp
-
memory/1732-83-0x0000000000000000-mapping.dmp
-
memory/1776-72-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-76-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-78-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-68-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-73-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-74-0x000000000047F6AE-mapping.dmp
-
memory/1776-71-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1776-69-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1932-67-0x0000000000300000-0x0000000000312000-memory.dmpFilesize
72KB
-
memory/1932-64-0x0000000000000000-mapping.dmp
-
memory/1980-84-0x0000000000000000-mapping.dmp
-
memory/1988-87-0x0000000000000000-mapping.dmp
-
memory/1988-89-0x0000000000D40000-0x0000000000D52000-memory.dmpFilesize
72KB