Analysis
-
max time kernel
43s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 16:32
Behavioral task
behavioral1
Sample
5bc149b7d429710d7539e6de3b655a11.exe
Resource
win7-20220812-en
General
-
Target
5bc149b7d429710d7539e6de3b655a11.exe
-
Size
208KB
-
MD5
5bc149b7d429710d7539e6de3b655a11
-
SHA1
7e32474bb18bad87408c0e8379acf563224dd5f4
-
SHA256
367286675076c14b4d7adedc674cd1902200003f703975bbfae71f5dfcdc18a6
-
SHA512
3a08d5571f4b0ce71a5d92a459b465c04d91a55abbf0ca5ebfc1d888ba10c1f50f0f5ec5ad8e1619d8403af154fd2af3536c26a7ca5d2a61fbee1028421f6648
-
SSDEEP
1536:sugPNTcI42LJ0dU33bIXSXLlgR6MdDID9tn4ICYlx:sug1TcI42LKG33bIJRNVW9tn4IDlx
Malware Config
Extracted
asyncrat
0.5.7B
Default
2.59.119.84:7943
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
zula.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/564-54-0x0000000000D30000-0x0000000000D6A000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\zula.exe asyncrat C:\Users\Admin\AppData\Roaming\zula.exe asyncrat C:\Users\Admin\AppData\Roaming\zula.exe asyncrat behavioral1/memory/960-65-0x00000000000C0000-0x00000000000FA000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
zula.exepid process 960 zula.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1940 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1448 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5bc149b7d429710d7539e6de3b655a11.exepid process 564 5bc149b7d429710d7539e6de3b655a11.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5bc149b7d429710d7539e6de3b655a11.exezula.exedescription pid process Token: SeDebugPrivilege 564 5bc149b7d429710d7539e6de3b655a11.exe Token: SeDebugPrivilege 960 zula.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
5bc149b7d429710d7539e6de3b655a11.execmd.execmd.exedescription pid process target process PID 564 wrote to memory of 2016 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 2016 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 2016 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 2016 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 1940 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 1940 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 1940 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 564 wrote to memory of 1940 564 5bc149b7d429710d7539e6de3b655a11.exe cmd.exe PID 1940 wrote to memory of 1448 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1448 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1448 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1448 1940 cmd.exe timeout.exe PID 2016 wrote to memory of 1224 2016 cmd.exe schtasks.exe PID 2016 wrote to memory of 1224 2016 cmd.exe schtasks.exe PID 2016 wrote to memory of 1224 2016 cmd.exe schtasks.exe PID 2016 wrote to memory of 1224 2016 cmd.exe schtasks.exe PID 1940 wrote to memory of 960 1940 cmd.exe zula.exe PID 1940 wrote to memory of 960 1940 cmd.exe zula.exe PID 1940 wrote to memory of 960 1940 cmd.exe zula.exe PID 1940 wrote to memory of 960 1940 cmd.exe zula.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bc149b7d429710d7539e6de3b655a11.exe"C:\Users\Admin\AppData\Local\Temp\5bc149b7d429710d7539e6de3b655a11.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "zula" /tr '"C:\Users\Admin\AppData\Roaming\zula.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "zula" /tr '"C:\Users\Admin\AppData\Roaming\zula.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2425.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\zula.exe"C:\Users\Admin\AppData\Roaming\zula.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2425.tmp.batFilesize
148B
MD59f68f49c5c3cd330f60aa284f68c25bc
SHA1d92cee61072f6884225c3dbc86d71b7109664d2c
SHA25669d0c4e52bf956f496e7fb130c756627dd2b35609c98a5842e2bc0e3ac797fbd
SHA51211dd6e6ed4827e3ae000ae49a399f42feb32783f39c94eb0d56ebe4260a33cbf59e591c732c7d20a419128f8a87f320b020040c111fa5eb2d5271b1a186a7471
-
C:\Users\Admin\AppData\Roaming\zula.exeFilesize
208KB
MD55bc149b7d429710d7539e6de3b655a11
SHA17e32474bb18bad87408c0e8379acf563224dd5f4
SHA256367286675076c14b4d7adedc674cd1902200003f703975bbfae71f5dfcdc18a6
SHA5123a08d5571f4b0ce71a5d92a459b465c04d91a55abbf0ca5ebfc1d888ba10c1f50f0f5ec5ad8e1619d8403af154fd2af3536c26a7ca5d2a61fbee1028421f6648
-
C:\Users\Admin\AppData\Roaming\zula.exeFilesize
208KB
MD55bc149b7d429710d7539e6de3b655a11
SHA17e32474bb18bad87408c0e8379acf563224dd5f4
SHA256367286675076c14b4d7adedc674cd1902200003f703975bbfae71f5dfcdc18a6
SHA5123a08d5571f4b0ce71a5d92a459b465c04d91a55abbf0ca5ebfc1d888ba10c1f50f0f5ec5ad8e1619d8403af154fd2af3536c26a7ca5d2a61fbee1028421f6648
-
\Users\Admin\AppData\Roaming\zula.exeFilesize
208KB
MD55bc149b7d429710d7539e6de3b655a11
SHA17e32474bb18bad87408c0e8379acf563224dd5f4
SHA256367286675076c14b4d7adedc674cd1902200003f703975bbfae71f5dfcdc18a6
SHA5123a08d5571f4b0ce71a5d92a459b465c04d91a55abbf0ca5ebfc1d888ba10c1f50f0f5ec5ad8e1619d8403af154fd2af3536c26a7ca5d2a61fbee1028421f6648
-
memory/564-54-0x0000000000D30000-0x0000000000D6A000-memory.dmpFilesize
232KB
-
memory/564-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB
-
memory/960-63-0x0000000000000000-mapping.dmp
-
memory/960-65-0x00000000000C0000-0x00000000000FA000-memory.dmpFilesize
232KB
-
memory/1224-60-0x0000000000000000-mapping.dmp
-
memory/1448-59-0x0000000000000000-mapping.dmp
-
memory/1940-57-0x0000000000000000-mapping.dmp
-
memory/2016-56-0x0000000000000000-mapping.dmp