Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 04:26
Behavioral task
behavioral1
Sample
7f2717a61bf9954670ea7c947815816e.exe
Resource
win7-20220901-en
General
-
Target
7f2717a61bf9954670ea7c947815816e.exe
-
Size
58KB
-
MD5
7f2717a61bf9954670ea7c947815816e
-
SHA1
7bf30b1291d800c583ac863856da257eaeecd531
-
SHA256
15d3ee4efbe7c1ebc998c69f2d6902fb26387c83dc49e41f54c2946c420120c1
-
SHA512
c5f652863f10c895c212bb2dbaa1b798f01db6344e99f70519590f67f8fc5d5ea760e9ba26b83bc256159d979364c8ec7a02db53ef42736e4756e987b0f5b829
-
SSDEEP
1536:4uyRNTAGo2W93pXGyb9Z5dqPPnHbJdRaMb:4uy/TAGo2U3pXGyb9ZiPvHbJjaMb
Malware Config
Extracted
asyncrat
0.5.7B
Spoofer
90.49.136.9:8080
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
AnyDesk.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1696-54-0x0000000000050000-0x0000000000064000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\AnyDesk.exe asyncrat \Users\Admin\AppData\Roaming\AnyDesk.exe asyncrat C:\Users\Admin\AppData\Roaming\AnyDesk.exe asyncrat behavioral1/memory/992-65-0x0000000000F70000-0x0000000000F84000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
AnyDesk.exepid process 992 AnyDesk.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1752 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1452 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7f2717a61bf9954670ea7c947815816e.exepid process 1696 7f2717a61bf9954670ea7c947815816e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7f2717a61bf9954670ea7c947815816e.exeAnyDesk.exedescription pid process Token: SeDebugPrivilege 1696 7f2717a61bf9954670ea7c947815816e.exe Token: SeDebugPrivilege 992 AnyDesk.exe Token: SeDebugPrivilege 992 AnyDesk.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
7f2717a61bf9954670ea7c947815816e.execmd.execmd.exedescription pid process target process PID 1696 wrote to memory of 1668 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1668 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1668 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1668 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1752 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1752 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1752 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1696 wrote to memory of 1752 1696 7f2717a61bf9954670ea7c947815816e.exe cmd.exe PID 1668 wrote to memory of 572 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 572 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 572 1668 cmd.exe schtasks.exe PID 1668 wrote to memory of 572 1668 cmd.exe schtasks.exe PID 1752 wrote to memory of 1452 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 1452 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 1452 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 1452 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 992 1752 cmd.exe AnyDesk.exe PID 1752 wrote to memory of 992 1752 cmd.exe AnyDesk.exe PID 1752 wrote to memory of 992 1752 cmd.exe AnyDesk.exe PID 1752 wrote to memory of 992 1752 cmd.exe AnyDesk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f2717a61bf9954670ea7c947815816e.exe"C:\Users\Admin\AppData\Local\Temp\7f2717a61bf9954670ea7c947815816e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AnyDesk" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "AnyDesk" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2721.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\AnyDesk.exe"C:\Users\Admin\AppData\Roaming\AnyDesk.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2721.tmp.batFilesize
151B
MD5ebcc90515cab8e8f2b5aa1cabab8cec7
SHA19fb328d75b14e206419f8dad4ffed9207fa4dae8
SHA2569089beaf86da2dfe8e1ebe252a0b1a7b208cdd8f8c1f4566bcdeaaf703e9c69b
SHA51250fef5e1d0bf540a618e7c2fee8a60730430a82de31be58f78e67cc0f65eb3f39e17ec5a22ed2d220cce2034df775c37c1d7363ec08d95607997b500c69002b4
-
C:\Users\Admin\AppData\Roaming\AnyDesk.exeFilesize
58KB
MD57f2717a61bf9954670ea7c947815816e
SHA17bf30b1291d800c583ac863856da257eaeecd531
SHA25615d3ee4efbe7c1ebc998c69f2d6902fb26387c83dc49e41f54c2946c420120c1
SHA512c5f652863f10c895c212bb2dbaa1b798f01db6344e99f70519590f67f8fc5d5ea760e9ba26b83bc256159d979364c8ec7a02db53ef42736e4756e987b0f5b829
-
C:\Users\Admin\AppData\Roaming\AnyDesk.exeFilesize
58KB
MD57f2717a61bf9954670ea7c947815816e
SHA17bf30b1291d800c583ac863856da257eaeecd531
SHA25615d3ee4efbe7c1ebc998c69f2d6902fb26387c83dc49e41f54c2946c420120c1
SHA512c5f652863f10c895c212bb2dbaa1b798f01db6344e99f70519590f67f8fc5d5ea760e9ba26b83bc256159d979364c8ec7a02db53ef42736e4756e987b0f5b829
-
\Users\Admin\AppData\Roaming\AnyDesk.exeFilesize
58KB
MD57f2717a61bf9954670ea7c947815816e
SHA17bf30b1291d800c583ac863856da257eaeecd531
SHA25615d3ee4efbe7c1ebc998c69f2d6902fb26387c83dc49e41f54c2946c420120c1
SHA512c5f652863f10c895c212bb2dbaa1b798f01db6344e99f70519590f67f8fc5d5ea760e9ba26b83bc256159d979364c8ec7a02db53ef42736e4756e987b0f5b829
-
memory/572-59-0x0000000000000000-mapping.dmp
-
memory/992-63-0x0000000000000000-mapping.dmp
-
memory/992-65-0x0000000000F70000-0x0000000000F84000-memory.dmpFilesize
80KB
-
memory/1452-60-0x0000000000000000-mapping.dmp
-
memory/1668-56-0x0000000000000000-mapping.dmp
-
memory/1696-54-0x0000000000050000-0x0000000000064000-memory.dmpFilesize
80KB
-
memory/1696-55-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1752-57-0x0000000000000000-mapping.dmp