Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09/09/2022, 13:01
Static task
static1
Behavioral task
behavioral1
Sample
ScanCopy378493rh1.scr.exe
Resource
win7-20220812-en
General
-
Target
ScanCopy378493rh1.scr.exe
-
Size
1.0MB
-
MD5
c5da839b1c6505b50f9d18588bc29dcc
-
SHA1
808bcb8114f6188448b06ef581965e6ee09d4562
-
SHA256
af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe
-
SHA512
03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d
-
SSDEEP
12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV
Malware Config
Extracted
asyncrat
0.5.7A
Ijefunds
79.134.225.20:8808
mmkawdairhcehilxluo
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
resource yara_rule behavioral1/memory/916-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-70-0x000000000040C62E-mapping.dmp asyncrat behavioral1/memory/916-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-74-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 544 set thread context of 916 544 ScanCopy378493rh1.scr.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1308 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 544 ScanCopy378493rh1.scr.exe Token: SeDebugPrivilege 940 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe 26 PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe 26 PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe 26 PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe 26 PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe 28 PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe 28 PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe 28 PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe 28 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30 PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rahWQrxsGOiUO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rahWQrxsGOiUO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4931.tmp"2⤵
- Creates scheduled task(s)
PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"2⤵PID:916
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b847d398f04a752619273c77bb047897
SHA11d487b760266f9f1d1bf60e9b301c314a56686a0
SHA25639d5b698f17feab1ee5fc3f46acfc17129c00f0fbb34125033d1db701baa835c
SHA512949dd54b91c8054d0cdea96250f41f648487af05ec9769d66ac0815b411d18993c6db38a3889dd1ccb474cd430a4b5646e25cabb212cee674b4e36cee18707e1