Overview
overview
10Static
static
10TrashMalwa...in.exe
windows10-2004-x64
8TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...nk.exe
windows10-2004-x64
8TrashMalwa...oN.bat
windows10-2004-x64
8TrashMalwa...zz.exe
windows10-2004-x64
6TrashMalwa...de.exe
windows10-2004-x64
8TrashMalwa...20.exe
windows10-2004-x64
7TrashMalwa...ll.exe
windows10-2004-x64
8TrashMalwa...le.exe
windows10-2004-x64
8TrashMalwa...oe.bat
windows10-2004-x64
TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows10-2004-x64
8TrashMalwa....0.exe
windows10-2004-x64
8TrashMalwa...ic.exe
windows10-2004-x64
6TrashMalwa...OD.exe
windows10-2004-x64
10TrashMalwa...um.exe
windows10-2004-x64
6TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...MZ.exe
windows10-2004-x64
1TrashMalwa...ch.exe
windows10-2004-x64
8TrashMalwa....5.exe
windows10-2004-x64
8TrashMalwa...ol.exe
windows10-2004-x64
8TrashMalwa...hm.exe
windows10-2004-x64
10TrashMalwa...10.exe
windows10-2004-x64
7TrashMalwa...V6.exe
windows10-2004-x64
7TrashMalwa.../x.exe
windows10-2004-x64
7Analysis
-
max time kernel
303s -
max time network
340s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 14:13
Behavioral task
behavioral1
Sample
TrashMalwares-main/AcidRain.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
TrashMalwares-main/FaZoN.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
TrashMalwares-main/Fizz.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral6
Sample
TrashMalwares-main/Ginxide.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral12
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
TrashMalwares-main/Phsyletric.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
TrashMalwares-main/RealBSOD.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
TrashMalwares-main/Sankylium.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
TrashMalwares-main/SuperWacker.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral18
Sample
TrashMalwares-main/TEMZ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
TrashMalwares-main/ach.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral20
Sample
TrashMalwares-main/even0.5.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
TrashMalwares-main/lol.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral22
Sample
TrashMalwares-main/mhm.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
TrashMalwares-main/winnit6.6.6 V10.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral24
Sample
TrashMalwares-main/winnit6.6.6_V6.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
TrashMalwares-main/x.exe
Resource
win10v2004-20220812-en
General
-
Target
TrashMalwares-main/mhm.exe
-
Size
47KB
-
MD5
21805f1841b424d2f2f107b408df2305
-
SHA1
d2ec7cbf70574673bc976075a48f7a14f4afeaa6
-
SHA256
b770e340090d677b9ad89ddca7e21fc435cf4562e9b14ffdb72e5134a0e3418f
-
SHA512
35e1910353ae781a030c535d79de686f28a51d4beadeef5702ef634c8000d9cd617e7f5d9a75aab0e06b545c375e7564b0fdceee3fd655735d1fae2cd137338b
-
SSDEEP
768:WuI3dTsErkZTWU/APhmo2qbmQccCV9xfqAsPIwT4viyI0bS2er4PoIhXKb1cKnxq:WuI3dTsX22J/N+ARwT4v9bS2A4gGKb1w
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:5552
127.0.0.1:19354
4.tcp.eu.ngrok.io:6606
4.tcp.eu.ngrok.io:7707
4.tcp.eu.ngrok.io:8808
4.tcp.eu.ngrok.io:5552
4.tcp.eu.ngrok.io:19354
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
lolo.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral22/memory/680-132-0x0000000000890000-0x00000000008A2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\lolo.exe asyncrat C:\Users\Admin\AppData\Roaming\lolo.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
lolo.exepid process 1828 lolo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mhm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mhm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3868 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
mhm.exepid process 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe 680 mhm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mhm.exelolo.exedescription pid process Token: SeDebugPrivilege 680 mhm.exe Token: SeDebugPrivilege 1828 lolo.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
mhm.execmd.execmd.exedescription pid process target process PID 680 wrote to memory of 3264 680 mhm.exe cmd.exe PID 680 wrote to memory of 3264 680 mhm.exe cmd.exe PID 680 wrote to memory of 3264 680 mhm.exe cmd.exe PID 680 wrote to memory of 3404 680 mhm.exe cmd.exe PID 680 wrote to memory of 3404 680 mhm.exe cmd.exe PID 680 wrote to memory of 3404 680 mhm.exe cmd.exe PID 3404 wrote to memory of 3868 3404 cmd.exe timeout.exe PID 3404 wrote to memory of 3868 3404 cmd.exe timeout.exe PID 3404 wrote to memory of 3868 3404 cmd.exe timeout.exe PID 3264 wrote to memory of 624 3264 cmd.exe schtasks.exe PID 3264 wrote to memory of 624 3264 cmd.exe schtasks.exe PID 3264 wrote to memory of 624 3264 cmd.exe schtasks.exe PID 3404 wrote to memory of 1828 3404 cmd.exe lolo.exe PID 3404 wrote to memory of 1828 3404 cmd.exe lolo.exe PID 3404 wrote to memory of 1828 3404 cmd.exe lolo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\mhm.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\mhm.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "lolo" /tr '"C:\Users\Admin\AppData\Roaming\lolo.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "lolo" /tr '"C:\Users\Admin\AppData\Roaming\lolo.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8155.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\lolo.exe"C:\Users\Admin\AppData\Roaming\lolo.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8155.tmp.batFilesize
148B
MD5cbabfd967452255a1c3f2fe241c89b46
SHA18f455b250f765c037d24e55ec926419664b461d5
SHA25675baa1a2a90ed650d897c69b0efaf550d573247f41ef7448592750825d99b19c
SHA5125cce2d6d7c8250fac20fd50b56a26fd083d0ff0e4ff8d8ff0424772d5f0495f66beeb72ecaaa7c1ab3415273786b5bf7c2263bac76103913bf31881aeed660ca
-
C:\Users\Admin\AppData\Roaming\lolo.exeFilesize
47KB
MD521805f1841b424d2f2f107b408df2305
SHA1d2ec7cbf70574673bc976075a48f7a14f4afeaa6
SHA256b770e340090d677b9ad89ddca7e21fc435cf4562e9b14ffdb72e5134a0e3418f
SHA51235e1910353ae781a030c535d79de686f28a51d4beadeef5702ef634c8000d9cd617e7f5d9a75aab0e06b545c375e7564b0fdceee3fd655735d1fae2cd137338b
-
C:\Users\Admin\AppData\Roaming\lolo.exeFilesize
47KB
MD521805f1841b424d2f2f107b408df2305
SHA1d2ec7cbf70574673bc976075a48f7a14f4afeaa6
SHA256b770e340090d677b9ad89ddca7e21fc435cf4562e9b14ffdb72e5134a0e3418f
SHA51235e1910353ae781a030c535d79de686f28a51d4beadeef5702ef634c8000d9cd617e7f5d9a75aab0e06b545c375e7564b0fdceee3fd655735d1fae2cd137338b
-
memory/624-139-0x0000000000000000-mapping.dmp
-
memory/680-132-0x0000000000890000-0x00000000008A2000-memory.dmpFilesize
72KB
-
memory/680-133-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/680-134-0x00000000059B0000-0x0000000005A4C000-memory.dmpFilesize
624KB
-
memory/1828-140-0x0000000000000000-mapping.dmp
-
memory/3264-135-0x0000000000000000-mapping.dmp
-
memory/3404-136-0x0000000000000000-mapping.dmp
-
memory/3868-138-0x0000000000000000-mapping.dmp