Analysis
-
max time kernel
69s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 19:45
Behavioral task
behavioral1
Sample
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe
Resource
win7-20220812-en
General
-
Target
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe
-
Size
72KB
-
MD5
04ffd19d0f37dbfb88183ed3a2be3e16
-
SHA1
55fc97fab3e9bb8028d0f488bfce17b9516c503f
-
SHA256
90636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
-
SHA512
c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
SSDEEP
768:QoBLMxx0Fs4G7WHNaIx2FAhQ7CbEjbegr3iS/dbR8kClZN2tYcFmVc6K:QoBLMxmy2hfEbhrSS1bRorNKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
urulyqqdpunjfhquxdy
-
delay
8
-
install
true
-
install_file
folders.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-54-0x0000000000060000-0x0000000000072000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\folders.exe asyncrat C:\Users\Admin\AppData\Roaming\folders.exe asyncrat behavioral1/memory/912-63-0x0000000000FB0000-0x0000000000FC2000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
folders.exepid process 912 folders.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 944 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exepid process 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exefolders.exedescription pid process Token: SeDebugPrivilege 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe Token: SeDebugPrivilege 912 folders.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.execmd.execmd.exedescription pid process target process PID 1976 wrote to memory of 1780 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 1976 wrote to memory of 1780 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 1976 wrote to memory of 1780 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 1780 wrote to memory of 1768 1780 cmd.exe schtasks.exe PID 1780 wrote to memory of 1768 1780 cmd.exe schtasks.exe PID 1780 wrote to memory of 1768 1780 cmd.exe schtasks.exe PID 1976 wrote to memory of 2016 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 1976 wrote to memory of 2016 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 1976 wrote to memory of 2016 1976 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 2016 wrote to memory of 944 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 944 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 944 2016 cmd.exe timeout.exe PID 2016 wrote to memory of 912 2016 cmd.exe folders.exe PID 2016 wrote to memory of 912 2016 cmd.exe folders.exe PID 2016 wrote to memory of 912 2016 cmd.exe folders.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB19.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\folders.exe"C:\Users\Admin\AppData\Roaming\folders.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB19.tmp.batFilesize
150B
MD50f0adf75a327df084820e507d310467e
SHA1f7459d10f280114443cdf387673ed4800b852227
SHA2565d2bc81bd5020ba4e6512ad081393bbf2e516f5284c87291b766e57b0b5b654c
SHA5129f5ec50a01e86c8d575c5824a813cc505a62a8d4ab3da55856dbf5eaa86f2bc3e31688ba0147697173fa6c174aa1252dc266b1322fa68411614267503ff8e261
-
C:\Users\Admin\AppData\Roaming\folders.exeFilesize
72KB
MD504ffd19d0f37dbfb88183ed3a2be3e16
SHA155fc97fab3e9bb8028d0f488bfce17b9516c503f
SHA25690636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
SHA512c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
C:\Users\Admin\AppData\Roaming\folders.exeFilesize
72KB
MD504ffd19d0f37dbfb88183ed3a2be3e16
SHA155fc97fab3e9bb8028d0f488bfce17b9516c503f
SHA25690636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
SHA512c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
memory/912-60-0x0000000000000000-mapping.dmp
-
memory/912-63-0x0000000000FB0000-0x0000000000FC2000-memory.dmpFilesize
72KB
-
memory/944-59-0x0000000000000000-mapping.dmp
-
memory/1768-56-0x0000000000000000-mapping.dmp
-
memory/1780-55-0x0000000000000000-mapping.dmp
-
memory/1976-54-0x0000000000060000-0x0000000000072000-memory.dmpFilesize
72KB
-
memory/2016-57-0x0000000000000000-mapping.dmp