Analysis
-
max time kernel
58s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 22:52
Static task
static1
Behavioral task
behavioral1
Sample
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe
Resource
win10v2004-20220812-en
General
-
Target
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe
-
Size
469KB
-
MD5
e8c534e58ab2b4959830d1f7e695e133
-
SHA1
01085c7b92329a6fa6995fdc1569a37218cd024b
-
SHA256
cc0dda64461cfc4a81291cab7fbf1b5fb60e288d5a5587108fb8f2f9381fdf7f
-
SHA512
94dbacca6a7fd1e14dd2327fab0a4f4e4e2f2f713a40adc1ad11549c134af3c57126786eef9474b3410e5a11360037dc175624289221601098fe74552a5c18ba
-
SSDEEP
6144:m7IaUaM8HGFHp1fQNXAsZRzK4+rLL447qvOeB6f8vkPclAMDkM7pPOQMLeX5e98F:mv6f8cPw9IWmlLh6bZq7t
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
nqjzitvqsflofawip
-
delay
6
-
install
true
-
install_file
facaboooke.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1132-55-0x00000000001B0000-0x00000000001C2000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
facaboooke.exepid process 600 facaboooke.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1576 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 964 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exepid process 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exefacaboooke.exedescription pid process Token: SeDebugPrivilege 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe Token: SeDebugPrivilege 600 facaboooke.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.execmd.execmd.exedescription pid process target process PID 1132 wrote to memory of 1276 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1276 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1276 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1276 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1576 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1576 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1576 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1132 wrote to memory of 1576 1132 CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe cmd.exe PID 1276 wrote to memory of 1292 1276 cmd.exe schtasks.exe PID 1276 wrote to memory of 1292 1276 cmd.exe schtasks.exe PID 1276 wrote to memory of 1292 1276 cmd.exe schtasks.exe PID 1276 wrote to memory of 1292 1276 cmd.exe schtasks.exe PID 1576 wrote to memory of 964 1576 cmd.exe timeout.exe PID 1576 wrote to memory of 964 1576 cmd.exe timeout.exe PID 1576 wrote to memory of 964 1576 cmd.exe timeout.exe PID 1576 wrote to memory of 964 1576 cmd.exe timeout.exe PID 1576 wrote to memory of 600 1576 cmd.exe facaboooke.exe PID 1576 wrote to memory of 600 1576 cmd.exe facaboooke.exe PID 1576 wrote to memory of 600 1576 cmd.exe facaboooke.exe PID 1576 wrote to memory of 600 1576 cmd.exe facaboooke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe"C:\Users\Admin\AppData\Local\Temp\CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558 /tr '"C:\Users\Admin\AppData\Roaming\facaboooke.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn CC0DDA64461CFC4A81291CAB7FBF1B5FB60E288D5A558 /tr '"C:\Users\Admin\AppData\Roaming\facaboooke.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5ACE.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\facaboooke.exe"C:\Users\Admin\AppData\Roaming\facaboooke.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5ACE.tmp.batFilesize
154B
MD56ffef9ccb4530c9314901fc86fb10e4b
SHA16f714db4078b94e134013a64a68d6dbb2d5f3bdb
SHA256bb2f6845577998d818eebd0092e44d7eb8d720abfaa69ed195c5c96247709de6
SHA51210157e38ed83876f1a1e23a961f3b40a91fbdd7781545eef54c5fc24fa03a073e1af4c08d40bf281ecbf90ee69a1ef49752cbb4829078c3a8c9694bb1ecb62e0
-
C:\Users\Admin\AppData\Roaming\facaboooke.exeFilesize
469KB
MD5e8c534e58ab2b4959830d1f7e695e133
SHA101085c7b92329a6fa6995fdc1569a37218cd024b
SHA256cc0dda64461cfc4a81291cab7fbf1b5fb60e288d5a5587108fb8f2f9381fdf7f
SHA51294dbacca6a7fd1e14dd2327fab0a4f4e4e2f2f713a40adc1ad11549c134af3c57126786eef9474b3410e5a11360037dc175624289221601098fe74552a5c18ba
-
C:\Users\Admin\AppData\Roaming\facaboooke.exeFilesize
469KB
MD5e8c534e58ab2b4959830d1f7e695e133
SHA101085c7b92329a6fa6995fdc1569a37218cd024b
SHA256cc0dda64461cfc4a81291cab7fbf1b5fb60e288d5a5587108fb8f2f9381fdf7f
SHA51294dbacca6a7fd1e14dd2327fab0a4f4e4e2f2f713a40adc1ad11549c134af3c57126786eef9474b3410e5a11360037dc175624289221601098fe74552a5c18ba
-
\Users\Admin\AppData\Roaming\facaboooke.exeFilesize
469KB
MD5e8c534e58ab2b4959830d1f7e695e133
SHA101085c7b92329a6fa6995fdc1569a37218cd024b
SHA256cc0dda64461cfc4a81291cab7fbf1b5fb60e288d5a5587108fb8f2f9381fdf7f
SHA51294dbacca6a7fd1e14dd2327fab0a4f4e4e2f2f713a40adc1ad11549c134af3c57126786eef9474b3410e5a11360037dc175624289221601098fe74552a5c18ba
-
memory/600-64-0x0000000000000000-mapping.dmp
-
memory/600-66-0x0000000000AE0000-0x0000000000B5A000-memory.dmpFilesize
488KB
-
memory/964-61-0x0000000000000000-mapping.dmp
-
memory/1132-55-0x00000000001B0000-0x00000000001C2000-memory.dmpFilesize
72KB
-
memory/1132-56-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1132-54-0x0000000000B00000-0x0000000000B7A000-memory.dmpFilesize
488KB
-
memory/1276-57-0x0000000000000000-mapping.dmp
-
memory/1292-60-0x0000000000000000-mapping.dmp
-
memory/1576-58-0x0000000000000000-mapping.dmp