Overview
overview
10Static
static
2bbea59df3...7e.exe
windows7-x64
102bbea59df3...7e.exe
windows10-1703-x64
102bbea59df3...7e.exe
windows10-2004-x64
102bbea59df3...7e.exe
windows11-21h2-x64
2bbea59df3...7e.exe
android-10-x64
2bbea59df3...7e.exe
android-11-x64
2bbea59df3...7e.exe
android-9-x86
2bbea59df3...7e.exe
macos-10.15-amd64
12bbea59df3...7e.exe
debian-9-armhf
2bbea59df3...7e.exe
debian-9-mips
2bbea59df3...7e.exe
debian-9-mipsel
2bbea59df3...7e.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
-
Size
2.2MB
-
MD5
b5f1a37cbd6c8a4690942fd254270ce1
-
SHA1
e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
-
SHA256
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
-
SHA512
6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
Malware Config
Extracted
asyncrat
0.5.7B
Default
76.8.53.133:62520
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
dwwm.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat behavioral3/memory/3424-145-0x0000000000C60000-0x0000000000C72000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Kxtwaidanpqpiuhprlehfsshclientip.exedwwm.exepid process 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 1280 dwwm.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Kxtwaidanpqpiuhprlehfsshclientip.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Keahz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tbsztbbv\\Keahz.exe\"" 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DBqQu = "C:\\Users\\Admin\\AppData\\Roaming\\DBqQu\\DBqQu.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription pid process target process PID 1436 set thread context of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 320 timeout.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
powershell.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exepid process 4072 powershell.exe 4072 powershell.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2324 InstallUtil.exe 2324 InstallUtil.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exepowershell.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exedwwm.exedescription pid process Token: SeDebugPrivilege 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 2324 InstallUtil.exe Token: SeDebugPrivilege 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe Token: SeDebugPrivilege 1280 dwwm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2324 InstallUtil.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.execmd.execmd.exedescription pid process target process PID 1436 wrote to memory of 4072 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1436 wrote to memory of 4072 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1436 wrote to memory of 4072 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 1436 wrote to memory of 3424 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1436 wrote to memory of 3424 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1436 wrote to memory of 3424 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 1436 wrote to memory of 1336 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 1336 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 1336 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 1436 wrote to memory of 2324 1436 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 3424 wrote to memory of 1520 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3424 wrote to memory of 1520 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3424 wrote to memory of 1520 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3424 wrote to memory of 1580 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3424 wrote to memory of 1580 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3424 wrote to memory of 1580 3424 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 1580 wrote to memory of 320 1580 cmd.exe timeout.exe PID 1580 wrote to memory of 320 1580 cmd.exe timeout.exe PID 1580 wrote to memory of 320 1580 cmd.exe timeout.exe PID 1520 wrote to memory of 1472 1520 cmd.exe schtasks.exe PID 1520 wrote to memory of 1472 1520 cmd.exe schtasks.exe PID 1520 wrote to memory of 1472 1520 cmd.exe schtasks.exe PID 1580 wrote to memory of 1280 1580 cmd.exe dwwm.exe PID 1580 wrote to memory of 1280 1580 cmd.exe dwwm.exe PID 1580 wrote to memory of 1280 1580 cmd.exe dwwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2EA1.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dwwm.exe"C:\Users\Admin\AppData\Roaming\dwwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\tmp2EA1.tmp.batFilesize
148B
MD55702e93697aab7388274b1049cf2a70a
SHA107a254d87f2e86ce19dff35c59058abf76235d05
SHA25636b320d3bae7b446ef76d5fe022d2c84cd802fbbde64e34fcb4353a81cd26a71
SHA51296bac39d2273dc28051e962664d2812ec69221d2b9fc8f70952320aad0c440bcb09174e8f7324651d90d9835349ece054c6cdcbd65dd352751517adab5122ca3
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
memory/320-155-0x0000000000000000-mapping.dmp
-
memory/1280-157-0x0000000000000000-mapping.dmp
-
memory/1336-146-0x0000000000000000-mapping.dmp
-
memory/1436-133-0x0000000005A90000-0x0000000005AB2000-memory.dmpFilesize
136KB
-
memory/1436-132-0x0000000000C40000-0x0000000000E74000-memory.dmpFilesize
2.2MB
-
memory/1472-156-0x0000000000000000-mapping.dmp
-
memory/1520-152-0x0000000000000000-mapping.dmp
-
memory/1580-153-0x0000000000000000-mapping.dmp
-
memory/2324-147-0x0000000000000000-mapping.dmp
-
memory/2324-148-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2324-149-0x0000000005390000-0x0000000005934000-memory.dmpFilesize
5.6MB
-
memory/2324-150-0x0000000004F20000-0x0000000004FB2000-memory.dmpFilesize
584KB
-
memory/2324-160-0x0000000005FA0000-0x0000000005FAA000-memory.dmpFilesize
40KB
-
memory/3424-145-0x0000000000C60000-0x0000000000C72000-memory.dmpFilesize
72KB
-
memory/3424-142-0x0000000000000000-mapping.dmp
-
memory/3424-151-0x0000000005620000-0x00000000056BC000-memory.dmpFilesize
624KB
-
memory/4072-140-0x0000000007D20000-0x000000000839A000-memory.dmpFilesize
6.5MB
-
memory/4072-139-0x00000000066D0000-0x00000000066EE000-memory.dmpFilesize
120KB
-
memory/4072-138-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/4072-137-0x00000000057A0000-0x0000000005806000-memory.dmpFilesize
408KB
-
memory/4072-136-0x00000000058B0000-0x0000000005ED8000-memory.dmpFilesize
6.2MB
-
memory/4072-135-0x0000000003120000-0x0000000003156000-memory.dmpFilesize
216KB
-
memory/4072-134-0x0000000000000000-mapping.dmp
-
memory/4072-141-0x0000000006BC0000-0x0000000006BDA000-memory.dmpFilesize
104KB