Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09-09-2022 13:01
Static task
static1
Behavioral task
behavioral1
Sample
ScanCopy378493rh1.scr.exe
Resource
win7-20220812-en
General
-
Target
ScanCopy378493rh1.scr.exe
-
Size
1.0MB
-
MD5
c5da839b1c6505b50f9d18588bc29dcc
-
SHA1
808bcb8114f6188448b06ef581965e6ee09d4562
-
SHA256
af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe
-
SHA512
03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d
-
SSDEEP
12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV
Malware Config
Extracted
asyncrat
0.5.7A
Ijefunds
79.134.225.20:8808
mmkawdairhcehilxluo
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/916-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-70-0x000000000040C62E-mapping.dmp asyncrat behavioral1/memory/916-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/916-74-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ScanCopy378493rh1.scr.exedescription pid process target process PID 544 set thread context of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ScanCopy378493rh1.scr.exepowershell.exepid process 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 544 ScanCopy378493rh1.scr.exe 940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ScanCopy378493rh1.scr.exepowershell.exedescription pid process Token: SeDebugPrivilege 544 ScanCopy378493rh1.scr.exe Token: SeDebugPrivilege 940 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ScanCopy378493rh1.scr.exedescription pid process target process PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe powershell.exe PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe powershell.exe PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe powershell.exe PID 544 wrote to memory of 940 544 ScanCopy378493rh1.scr.exe powershell.exe PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe schtasks.exe PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe schtasks.exe PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe schtasks.exe PID 544 wrote to memory of 1308 544 ScanCopy378493rh1.scr.exe schtasks.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe PID 544 wrote to memory of 916 544 ScanCopy378493rh1.scr.exe ScanCopy378493rh1.scr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rahWQrxsGOiUO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rahWQrxsGOiUO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4931.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4931.tmpFilesize
1KB
MD5b847d398f04a752619273c77bb047897
SHA11d487b760266f9f1d1bf60e9b301c314a56686a0
SHA25639d5b698f17feab1ee5fc3f46acfc17129c00f0fbb34125033d1db701baa835c
SHA512949dd54b91c8054d0cdea96250f41f648487af05ec9769d66ac0815b411d18993c6db38a3889dd1ccb474cd430a4b5646e25cabb212cee674b4e36cee18707e1
-
memory/544-63-0x0000000001150000-0x0000000001162000-memory.dmpFilesize
72KB
-
memory/544-55-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/544-56-0x00000000002C0000-0x00000000002DA000-memory.dmpFilesize
104KB
-
memory/544-58-0x0000000005D30000-0x0000000005D9E000-memory.dmpFilesize
440KB
-
memory/544-57-0x00000000004A0000-0x00000000004AC000-memory.dmpFilesize
48KB
-
memory/544-54-0x0000000001170000-0x0000000001276000-memory.dmpFilesize
1.0MB
-
memory/916-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-70-0x000000000040C62E-mapping.dmp
-
memory/916-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/916-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-77-0x000000006E7E0000-0x000000006ED8B000-memory.dmpFilesize
5.7MB
-
memory/940-59-0x0000000000000000-mapping.dmp
-
memory/940-75-0x000000006E7E0000-0x000000006ED8B000-memory.dmpFilesize
5.7MB
-
memory/1308-60-0x0000000000000000-mapping.dmp