Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 11:10
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
641KB
-
MD5
cd67ba75d4806b402025205991a2c21a
-
SHA1
b7da7ff58dd3a75dfcf1998798120cde3af9b50f
-
SHA256
8e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
-
SHA512
94cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
SSDEEP
12288:ckBnMd/SN7xFGPYsUEeBujfFT6QGJ26ThJkXvJvwgebrXB4X:c1/nXp6urFT6QGJHhCXSzfe
Malware Config
Extracted
asyncrat
1.0.7
Default
195.133.18.181:8878
DcRatMutex_qwqdanchunadsadasadda
-
delay
1
-
install
true
-
install_file
ExacqVision.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1712-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1712-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1712-64-0x000000000040CBDE-mapping.dmp asyncrat behavioral1/memory/1712-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1712-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1980-88-0x000000000040CBDE-mapping.dmp asyncrat behavioral1/memory/1980-91-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1980-93-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
ExacqVision.exeExacqVision.exepid process 1884 ExacqVision.exe 1980 ExacqVision.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exeExacqVision.exepid process 1076 cmd.exe 1884 ExacqVision.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
tmp.exeExacqVision.exedescription pid process target process PID 544 set thread context of 1712 544 tmp.exe tmp.exe PID 1884 set thread context of 1980 1884 ExacqVision.exe ExacqVision.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1396 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
tmp.exepid process 1712 tmp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
tmp.exetmp.exeExacqVision.exeExacqVision.exedescription pid process Token: SeDebugPrivilege 544 tmp.exe Token: SeDebugPrivilege 1712 tmp.exe Token: SeDebugPrivilege 1884 ExacqVision.exe Token: SeDebugPrivilege 1980 ExacqVision.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
tmp.exetmp.execmd.execmd.exeExacqVision.exedescription pid process target process PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 544 wrote to memory of 1712 544 tmp.exe tmp.exe PID 1712 wrote to memory of 1324 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1324 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1324 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1324 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1076 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1076 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1076 1712 tmp.exe cmd.exe PID 1712 wrote to memory of 1076 1712 tmp.exe cmd.exe PID 1324 wrote to memory of 1108 1324 cmd.exe schtasks.exe PID 1324 wrote to memory of 1108 1324 cmd.exe schtasks.exe PID 1324 wrote to memory of 1108 1324 cmd.exe schtasks.exe PID 1324 wrote to memory of 1108 1324 cmd.exe schtasks.exe PID 1076 wrote to memory of 1396 1076 cmd.exe timeout.exe PID 1076 wrote to memory of 1396 1076 cmd.exe timeout.exe PID 1076 wrote to memory of 1396 1076 cmd.exe timeout.exe PID 1076 wrote to memory of 1396 1076 cmd.exe timeout.exe PID 1076 wrote to memory of 1884 1076 cmd.exe ExacqVision.exe PID 1076 wrote to memory of 1884 1076 cmd.exe ExacqVision.exe PID 1076 wrote to memory of 1884 1076 cmd.exe ExacqVision.exe PID 1076 wrote to memory of 1884 1076 cmd.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe PID 1884 wrote to memory of 1980 1884 ExacqVision.exe ExacqVision.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ExacqVision" /tr '"C:\Users\Admin\AppData\Local\Temp\ExacqVision.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ExacqVision" /tr '"C:\Users\Admin\AppData\Local\Temp\ExacqVision.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC746.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\ExacqVision.exe"C:\Users\Admin\AppData\Local\Temp\ExacqVision.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ExacqVision.exeC:\Users\Admin\AppData\Local\Temp\ExacqVision.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ExacqVision.exeFilesize
641KB
MD5cd67ba75d4806b402025205991a2c21a
SHA1b7da7ff58dd3a75dfcf1998798120cde3af9b50f
SHA2568e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
SHA51294cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
C:\Users\Admin\AppData\Local\Temp\ExacqVision.exeFilesize
641KB
MD5cd67ba75d4806b402025205991a2c21a
SHA1b7da7ff58dd3a75dfcf1998798120cde3af9b50f
SHA2568e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
SHA51294cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
C:\Users\Admin\AppData\Local\Temp\ExacqVision.exeFilesize
641KB
MD5cd67ba75d4806b402025205991a2c21a
SHA1b7da7ff58dd3a75dfcf1998798120cde3af9b50f
SHA2568e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
SHA51294cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
C:\Users\Admin\AppData\Local\Temp\tmpC746.tmp.batFilesize
158B
MD5656b10920dcbbe6ae33cde23204dc99f
SHA1f200458bfe1604d6f2457c2ca89037f9c4cebbdc
SHA25601b694fb975590d4d60a0f28f3ff2a5ae5e9da7bdd5df4f1f455f007f2f8b1e3
SHA512cc9b1e5ac77394ba463b24ad2cc19dfb1242ab327fdb3b1d8381c7a89d74e0d08fdae9e47735755bdd2fc3cbb915faa5076206a35ffef1d00b5a30480e747fcc
-
\Users\Admin\AppData\Local\Temp\ExacqVision.exeFilesize
641KB
MD5cd67ba75d4806b402025205991a2c21a
SHA1b7da7ff58dd3a75dfcf1998798120cde3af9b50f
SHA2568e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
SHA51294cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
\Users\Admin\AppData\Local\Temp\ExacqVision.exeFilesize
641KB
MD5cd67ba75d4806b402025205991a2c21a
SHA1b7da7ff58dd3a75dfcf1998798120cde3af9b50f
SHA2568e01aa31c94e31de086a742c522520282d8b7fb784bc1875e0c005debfa77a4a
SHA51294cc00ba428fb1befeb4c3480cfc5f6eb63ac2dbd83b9da701453196b3aab6c6d060363c8c2b01d3e7a6a85836992e705546231fe21e6af38d5ca4eaa8775fa8
-
memory/544-54-0x00000000011D0000-0x0000000001276000-memory.dmpFilesize
664KB
-
memory/544-55-0x0000000000440000-0x00000000004E6000-memory.dmpFilesize
664KB
-
memory/544-56-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/544-57-0x0000000004750000-0x00000000047E2000-memory.dmpFilesize
584KB
-
memory/1076-71-0x0000000000000000-mapping.dmp
-
memory/1108-72-0x0000000000000000-mapping.dmp
-
memory/1324-70-0x0000000000000000-mapping.dmp
-
memory/1396-74-0x0000000000000000-mapping.dmp
-
memory/1712-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-64-0x000000000040CBDE-mapping.dmp
-
memory/1712-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1884-77-0x0000000000000000-mapping.dmp
-
memory/1884-79-0x0000000000310000-0x00000000003B6000-memory.dmpFilesize
664KB
-
memory/1980-88-0x000000000040CBDE-mapping.dmp
-
memory/1980-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1980-93-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB