Analysis
-
max time kernel
139s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 19:45
Behavioral task
behavioral1
Sample
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe
Resource
win7-20220812-en
General
-
Target
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe
-
Size
72KB
-
MD5
04ffd19d0f37dbfb88183ed3a2be3e16
-
SHA1
55fc97fab3e9bb8028d0f488bfce17b9516c503f
-
SHA256
90636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
-
SHA512
c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
SSDEEP
768:QoBLMxx0Fs4G7WHNaIx2FAhQ7CbEjbegr3iS/dbR8kClZN2tYcFmVc6K:QoBLMxmy2hfEbhrSS1bRorNKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
urulyqqdpunjfhquxdy
-
delay
8
-
install
true
-
install_file
folders.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/632-132-0x0000000000A30000-0x0000000000A42000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\folders.exe asyncrat C:\Users\Admin\AppData\Roaming\folders.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
folders.exepid process 3632 folders.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3152 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exepid process 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.exefolders.exedescription pid process Token: SeDebugPrivilege 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe Token: SeDebugPrivilege 3632 folders.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1096-57-0x00000000003B0000-0x00000000003C2000-memory.execmd.execmd.exedescription pid process target process PID 632 wrote to memory of 4348 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 632 wrote to memory of 4348 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 632 wrote to memory of 5116 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 632 wrote to memory of 5116 632 1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe cmd.exe PID 4348 wrote to memory of 1232 4348 cmd.exe schtasks.exe PID 4348 wrote to memory of 1232 4348 cmd.exe schtasks.exe PID 5116 wrote to memory of 3152 5116 cmd.exe timeout.exe PID 5116 wrote to memory of 3152 5116 cmd.exe timeout.exe PID 5116 wrote to memory of 3632 5116 cmd.exe folders.exe PID 5116 wrote to memory of 3632 5116 cmd.exe folders.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1096-57-0x00000000003B0000-0x00000000003C2000-memory.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 1096-57-0x00000000003B0000-0x00000000003C2000-memory /tr '"C:\Users\Admin\AppData\Roaming\folders.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp12DC.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\folders.exe"C:\Users\Admin\AppData\Roaming\folders.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp12DC.tmp.batFilesize
151B
MD5e15ed499a7f23aa1db906869e87a9499
SHA17c3af578f1e0a706c1d9991403fa0e7afba5b217
SHA2562c284d690dcf9dce5f3733b04ff3d07a4b252df5625cd8cb2527cd8412a0b521
SHA5120ed6bbfc41fe960746a7e03ab56c1a36f126cb908abdf83622e778d9dd6025ae383e14ddf711f704ed9a18334f7c7ae4a9f967dad6bf136f08d24e426720eb14
-
C:\Users\Admin\AppData\Roaming\folders.exeFilesize
72KB
MD504ffd19d0f37dbfb88183ed3a2be3e16
SHA155fc97fab3e9bb8028d0f488bfce17b9516c503f
SHA25690636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
SHA512c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
C:\Users\Admin\AppData\Roaming\folders.exeFilesize
72KB
MD504ffd19d0f37dbfb88183ed3a2be3e16
SHA155fc97fab3e9bb8028d0f488bfce17b9516c503f
SHA25690636b07f3e1ba7875174defe0e106aa1aa873960e3380e9cc9a5f0325bf13b6
SHA512c40645de659bde18d34c336251eea7229c49d569cc7127691f188a4efb0e8fe2e10b84d0a45c4f24982cf732cb34ca2c3742d07af2d9b1d61ba7bf359f031ef4
-
memory/632-132-0x0000000000A30000-0x0000000000A42000-memory.dmpFilesize
72KB
-
memory/632-133-0x00007FFA79D60000-0x00007FFA7A821000-memory.dmpFilesize
10.8MB
-
memory/632-134-0x00007FFA79D60000-0x00007FFA7A821000-memory.dmpFilesize
10.8MB
-
memory/632-137-0x00007FFA79D60000-0x00007FFA7A821000-memory.dmpFilesize
10.8MB
-
memory/1232-139-0x0000000000000000-mapping.dmp
-
memory/3152-140-0x0000000000000000-mapping.dmp
-
memory/3632-141-0x0000000000000000-mapping.dmp
-
memory/3632-144-0x00007FFA79E10000-0x00007FFA7A8D1000-memory.dmpFilesize
10.8MB
-
memory/3632-145-0x00007FFA79E10000-0x00007FFA7A8D1000-memory.dmpFilesize
10.8MB
-
memory/4348-135-0x0000000000000000-mapping.dmp
-
memory/5116-136-0x0000000000000000-mapping.dmp