Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
Kleinschmidt GmbH Invoices - Payment Receipt.exe
Resource
win7-20220812-en
General
-
Target
Kleinschmidt GmbH Invoices - Payment Receipt.exe
-
Size
796KB
-
MD5
3d2af31c95b477dc90f42b825ad7c126
-
SHA1
9064ca55686edead9351d49c911c184caa236ae7
-
SHA256
1fec1e11e26b8d1de831b50ff0163dfca3a751e3bb28ea372b54a7c9cc19cff6
-
SHA512
8da1a7c125eee396cbc7e5a386503ce60c6ef2f187e0d158ab7491e60b90913df452fce94190821c1b41c819963879869756f6cbfe35c44e60efe71dafe1805d
-
SSDEEP
6144:Gk4I1/j6U/sWc918LevX14oT61JDC2ya7/yo5tNLCFC7z/7tkW/x2RDXY3/+75f0:0UuscX8LqFY1JD/moblCAz5V/qYPe
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6305
209.127.186.218:6305
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
MicroSoft-win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4996-150-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Kleinschmidt GmbH Invoices - Payment Receipt.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Kleinschmidt GmbH Invoices - Payment Receipt.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Kleinschmidt GmbH Invoices - Payment Receipt.exedescription pid process target process PID 2188 set thread context of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Kleinschmidt GmbH Invoices - Payment Receipt.exepowershell.exepowershell.exepid process 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 308 powershell.exe 4756 powershell.exe 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe 4756 powershell.exe 308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Kleinschmidt GmbH Invoices - Payment Receipt.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Token: SeDebugPrivilege 308 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Kleinschmidt GmbH Invoices - Payment Receipt.exedescription pid process target process PID 2188 wrote to memory of 4756 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 4756 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 4756 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 308 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 308 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 308 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe powershell.exe PID 2188 wrote to memory of 3392 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe schtasks.exe PID 2188 wrote to memory of 3392 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe schtasks.exe PID 2188 wrote to memory of 3392 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe schtasks.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe PID 2188 wrote to memory of 4996 2188 Kleinschmidt GmbH Invoices - Payment Receipt.exe Kleinschmidt GmbH Invoices - Payment Receipt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bVUhnvekcvHWd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bVUhnvekcvHWd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7BF6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5913240a0ecdd4e5143fd491b71a3b46d
SHA1419de92c376f2595eb56dffe1eec84c6cdb3791e
SHA2569ec8df3739010942d5531e29fca9f9db017240bc065867fc5cd5ea329e7e5450
SHA5121044f0d104f32b86037c0995a145632fcf45c537092ef7050562f0bd01031864cbac4fb7273997131a28f91ae51be17a7d20eb9098fb539ea5c940dce30366d2
-
C:\Users\Admin\AppData\Local\Temp\tmp7BF6.tmpFilesize
1KB
MD57f8afc4bc919dca98113b44900af9915
SHA1d4f80e19265ebddf432eb20a56f5558109c35e01
SHA2568a568ae935b3adfb91c79ad0fde4637526abc976f9a294cbc6ee56a91bc53b68
SHA512b56abc39f714c760aaf70fc0cc86a7b1a1581168f3778e176b199984f802430ed099de885407006eb4a3b8704cf0adda7b9d9dbc1aff9a9454266a1f53672c5d
-
memory/308-160-0x0000000007A10000-0x0000000007A1E000-memory.dmpFilesize
56KB
-
memory/308-161-0x0000000007B20000-0x0000000007B3A000-memory.dmpFilesize
104KB
-
memory/308-154-0x0000000007490000-0x00000000074AE000-memory.dmpFilesize
120KB
-
memory/308-157-0x00000000077E0000-0x00000000077FA000-memory.dmpFilesize
104KB
-
memory/308-142-0x0000000000000000-mapping.dmp
-
memory/308-153-0x00000000757A0000-0x00000000757EC000-memory.dmpFilesize
304KB
-
memory/308-159-0x0000000007A60000-0x0000000007AF6000-memory.dmpFilesize
600KB
-
memory/308-162-0x0000000007B00000-0x0000000007B08000-memory.dmpFilesize
32KB
-
memory/308-147-0x0000000005530000-0x0000000005552000-memory.dmpFilesize
136KB
-
memory/308-151-0x00000000064C0000-0x00000000064DE000-memory.dmpFilesize
120KB
-
memory/308-148-0x0000000005E00000-0x0000000005E66000-memory.dmpFilesize
408KB
-
memory/2188-137-0x00000000059F0000-0x0000000005A82000-memory.dmpFilesize
584KB
-
memory/2188-135-0x0000000000FA0000-0x000000000106C000-memory.dmpFilesize
816KB
-
memory/2188-136-0x0000000005FA0000-0x0000000006544000-memory.dmpFilesize
5.6MB
-
memory/2188-139-0x0000000009420000-0x00000000094BC000-memory.dmpFilesize
624KB
-
memory/2188-138-0x0000000005B80000-0x0000000005B8A000-memory.dmpFilesize
40KB
-
memory/2188-140-0x0000000009750000-0x00000000097B6000-memory.dmpFilesize
408KB
-
memory/3392-144-0x0000000000000000-mapping.dmp
-
memory/4756-156-0x0000000007E00000-0x000000000847A000-memory.dmpFilesize
6.5MB
-
memory/4756-155-0x00000000757A0000-0x00000000757EC000-memory.dmpFilesize
304KB
-
memory/4756-158-0x00000000077A0000-0x00000000077AA000-memory.dmpFilesize
40KB
-
memory/4756-152-0x0000000006A00000-0x0000000006A32000-memory.dmpFilesize
200KB
-
memory/4756-145-0x00000000055A0000-0x0000000005BC8000-memory.dmpFilesize
6.2MB
-
memory/4756-143-0x0000000004E60000-0x0000000004E96000-memory.dmpFilesize
216KB
-
memory/4756-141-0x0000000000000000-mapping.dmp
-
memory/4996-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4996-149-0x0000000000000000-mapping.dmp