Analysis
-
max time kernel
177s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-08-2022 06:32
General
-
Target
BcJRFxiQTFDdmBX.exe
-
Size
48KB
-
MD5
a671a69d4e3f7425bf163eae052250ff
-
SHA1
80c47eae696348b607f5f54ab3101c10c64192ce
-
SHA256
447f95e2299fbab8e30669f1fd5c71b2e69499e25adae3373093c0317f53fdc5
-
SHA512
527a88921d628ffbe1cfbe21f204e3dbf3cea026129c6a9e3d713a82b9c9e6f75155f5da4bfe2f14845d6542cdbe129fa72214b028c4fdc397456d33f789a85b
-
SSDEEP
768:mbRJZBILLWQ9+jiwtelDSN+iV08Ybygecb+zqBEmyIvEgK/JbZVc6KN:mbRq9wtKDs4zb1pu9xInkJbZVclN
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BcJRFxiQTFDdmBX.exe"C:\Users\Admin\AppData\Local\Temp\BcJRFxiQTFDdmBX.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Service " /tr '"C:\Users\Admin\AppData\Roaming\Windows Service .exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Service " /tr '"C:\Users\Admin\AppData\Roaming\Windows Service .exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp75CC.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Windows Service .exe"C:\Users\Admin\AppData\Roaming\Windows Service .exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD53a865c5450718d8c5d1f755f18470ed2
SHA187448774a0259d06cbdcc26a6356dcc1a9df048c
SHA256708ed4d17c3fb8e5dbf99508cd7ab1598ec4daaa6bf21db0a816c41386a1f3e6
SHA512ee2cb5c7c50c4ab5d3502b33d003f7c88510dde6d55e5b690efdc7ff51db162777675cf72724f36f7f6d6830d3c1873a73bf7706230f40ee9b7b4babda4e6f7b
-
Filesize
48KB
MD5a671a69d4e3f7425bf163eae052250ff
SHA180c47eae696348b607f5f54ab3101c10c64192ce
SHA256447f95e2299fbab8e30669f1fd5c71b2e69499e25adae3373093c0317f53fdc5
SHA512527a88921d628ffbe1cfbe21f204e3dbf3cea026129c6a9e3d713a82b9c9e6f75155f5da4bfe2f14845d6542cdbe129fa72214b028c4fdc397456d33f789a85b
-
Filesize
48KB
MD5a671a69d4e3f7425bf163eae052250ff
SHA180c47eae696348b607f5f54ab3101c10c64192ce
SHA256447f95e2299fbab8e30669f1fd5c71b2e69499e25adae3373093c0317f53fdc5
SHA512527a88921d628ffbe1cfbe21f204e3dbf3cea026129c6a9e3d713a82b9c9e6f75155f5da4bfe2f14845d6542cdbe129fa72214b028c4fdc397456d33f789a85b
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
10.8MB