Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 15:23
Static task
static1
Behavioral task
behavioral1
Sample
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe
Resource
win10v2004-20220812-en
General
-
Target
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe
-
Size
1.5MB
-
MD5
26454b46bef46b885e8477922d3d08d4
-
SHA1
add2c041f12ce35e621dd3e162a61a7196eee48c
-
SHA256
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282
-
SHA512
a9a41ccbc6b98cbfb7a0b6c2843f35fc895e6ec9556848ac4dd93e8e2a40b2079b906c2ee6fa90857cf267215cf2088c8f97828c9b3e40f80e6ad2e57d67da98
-
SSDEEP
49152:Ag6cnCiIkofSoKkVOUUi12RK27PB6yy0E6MenVeUQu:4VdSF3i12XDB62thUUj
Malware Config
Extracted
asyncrat
0.5.7B
Default
190.123.44.184:8012
190.123.44.184:8201
190.123.44.184:3321
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-79-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1544-84-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1544-82-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
DllHelper.exepid process 1640 DllHelper.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1224 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exepid process 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DllHelper.exedescription pid process target process PID 1640 set thread context of 1544 1640 DllHelper.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exeDllHelper.exepid process 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe 1640 DllHelper.exe 1640 DllHelper.exe 1640 DllHelper.exe 1640 DllHelper.exe 1640 DllHelper.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.execmd.exeDllHelper.exedescription pid process target process PID 1200 wrote to memory of 1300 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe schtasks.exe PID 1200 wrote to memory of 1300 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe schtasks.exe PID 1200 wrote to memory of 1300 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe schtasks.exe PID 1200 wrote to memory of 1300 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe schtasks.exe PID 1200 wrote to memory of 1640 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe DllHelper.exe PID 1200 wrote to memory of 1640 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe DllHelper.exe PID 1200 wrote to memory of 1640 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe DllHelper.exe PID 1200 wrote to memory of 1640 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe DllHelper.exe PID 1200 wrote to memory of 1224 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe cmd.exe PID 1200 wrote to memory of 1224 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe cmd.exe PID 1200 wrote to memory of 1224 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe cmd.exe PID 1200 wrote to memory of 1224 1200 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe cmd.exe PID 1224 wrote to memory of 1760 1224 cmd.exe chcp.com PID 1224 wrote to memory of 1760 1224 cmd.exe chcp.com PID 1224 wrote to memory of 1760 1224 cmd.exe chcp.com PID 1224 wrote to memory of 1760 1224 cmd.exe chcp.com PID 1224 wrote to memory of 1356 1224 cmd.exe PING.EXE PID 1224 wrote to memory of 1356 1224 cmd.exe PING.EXE PID 1224 wrote to memory of 1356 1224 cmd.exe PING.EXE PID 1224 wrote to memory of 1356 1224 cmd.exe PING.EXE PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe PID 1640 wrote to memory of 1544 1640 DllHelper.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe"C:\Users\Admin\AppData\Local\Temp\47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppVerif\DllHelper.exe"C:\Users\Admin\AppVerif\DllHelper.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppVerif\DllHelper.exeFilesize
767.5MB
MD5c754ee72428be0a61771cbd91378f979
SHA11fa98e9cba7b2b31b45ea01e17fe7f4a74bebd43
SHA256a20f9f7b015122b7d162c0dd1b738e0553b0800e4fa9c0cd6d770e0edc5cf583
SHA5126fd29bc1603863e9d3f1cc8f4261c285c9854b95dd133a2b6b1852d1fe6ea713dc3ed7f8278adfa126e3c5bb724acc0072bdf582e1df83d6cac527b70208dcd5
-
\Users\Admin\AppVerif\DllHelper.exeFilesize
767.5MB
MD5c754ee72428be0a61771cbd91378f979
SHA11fa98e9cba7b2b31b45ea01e17fe7f4a74bebd43
SHA256a20f9f7b015122b7d162c0dd1b738e0553b0800e4fa9c0cd6d770e0edc5cf583
SHA5126fd29bc1603863e9d3f1cc8f4261c285c9854b95dd133a2b6b1852d1fe6ea713dc3ed7f8278adfa126e3c5bb724acc0072bdf582e1df83d6cac527b70208dcd5
-
memory/1200-66-0x0000000002580000-0x00000000026EA000-memory.dmpFilesize
1.4MB
-
memory/1200-58-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1200-57-0x0000000002580000-0x00000000026EA000-memory.dmpFilesize
1.4MB
-
memory/1200-56-0x0000000002580000-0x00000000026EA000-memory.dmpFilesize
1.4MB
-
memory/1200-55-0x0000000001E40000-0x0000000002576000-memory.dmpFilesize
7.2MB
-
memory/1200-60-0x0000000001E40000-0x0000000002576000-memory.dmpFilesize
7.2MB
-
memory/1200-64-0x0000000002580000-0x00000000026EA000-memory.dmpFilesize
1.4MB
-
memory/1200-54-0x0000000001E40000-0x0000000002576000-memory.dmpFilesize
7.2MB
-
memory/1224-65-0x0000000000000000-mapping.dmp
-
memory/1300-59-0x0000000000000000-mapping.dmp
-
memory/1356-68-0x0000000000000000-mapping.dmp
-
memory/1544-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1544-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1544-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1544-84-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1640-75-0x000000000C1F0000-0x000000000C2A2000-memory.dmpFilesize
712KB
-
memory/1640-72-0x0000000002650000-0x00000000027BA000-memory.dmpFilesize
1.4MB
-
memory/1640-74-0x000000000C1F0000-0x000000000C2A2000-memory.dmpFilesize
712KB
-
memory/1640-69-0x0000000001F10000-0x0000000002646000-memory.dmpFilesize
7.2MB
-
memory/1640-78-0x0000000002650000-0x00000000027BA000-memory.dmpFilesize
1.4MB
-
memory/1640-80-0x0000000002650000-0x00000000027BA000-memory.dmpFilesize
1.4MB
-
memory/1640-71-0x0000000002650000-0x00000000027BA000-memory.dmpFilesize
1.4MB
-
memory/1640-62-0x0000000000000000-mapping.dmp
-
memory/1640-70-0x0000000001F10000-0x0000000002646000-memory.dmpFilesize
7.2MB
-
memory/1760-67-0x0000000000000000-mapping.dmp