Analysis
-
max time kernel
80s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2022 18:52
Static task
static1
Behavioral task
behavioral1
Sample
aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28.ps1
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28.ps1
Resource
win10v2004-20220812-en
General
-
Target
aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28.ps1
-
Size
187KB
-
MD5
a345138c96b8d5b50e401192b819d49d
-
SHA1
bdcc4ef88b1d5377409ad2f45fcb4e04d8fba5c3
-
SHA256
aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28
-
SHA512
942d48b221dbe2a67b9edc5992aef3a54438befe715ded5996437b17ed2ccad1c647b74273792567819c3cca8f95940595cbd8e25d9c6a43c391452770c77bed
-
SSDEEP
3072:ngijttzaOYYzmqIzDNSuoT3ApmNwLqU/QIU:nT/zaOYYz4zDNo3Apm6qU/QIU
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AAAAAAAAAAAA+++AAAAAAAAAAAA
chromedata.accesscam.org:7707
chromedata.accesscam.org:4404
chromedata.accesscam.org:5505
chromedata.accesscam.org:3303
chromedata.accesscam.org:2222
chromedata.accesscam.org:6606
chromedata.accesscam.org:8808
chromedata.accesscam.org:5155
chromedata.accesscam.org:5122
chromedata.accesscam.org:8001
chromedata.accesscam.org:9000
chromedata.accesscam.org:9999
chromedata.accesscam.org:8888
cdt.3utilities.com:7707
cdt.3utilities.com:4404
cdt.3utilities.com:5505
cdt.3utilities.com:3303
cdt.3utilities.com:2222
cdt.3utilities.com:6606
cdt.3utilities.com:8808
cdt.3utilities.com:5155
cdt.3utilities.com:5122
cdt.3utilities.com:8001
cdt.3utilities.com:9000
cdt.3utilities.com:9999
cdt.3utilities.com:8888
adobedata.webredirect.org:7707
adobedata.webredirect.org:4404
adobedata.webredirect.org:5505
adobedata.webredirect.org:3303
adobedata.webredirect.org:2222
adobedata.webredirect.org:6606
adobedata.webredirect.org:8808
adobedata.webredirect.org:5155
adobedata.webredirect.org:5122
adobedata.webredirect.org:8001
adobedata.webredirect.org:9000
adobedata.webredirect.org:9999
adobedata.webredirect.org:8888
127.0.0.1:7707
127.0.0.1:4404
127.0.0.1:5505
127.0.0.1:3303
127.0.0.1:2222
127.0.0.1:6606
127.0.0.1:8808
127.0.0.1:5155
127.0.0.1:5122
127.0.0.1:8001
127.0.0.1:9000
127.0.0.1:9999
127.0.0.1:8888
dimascu.duckdns.org:7707
dimascu.duckdns.org:4404
dimascu.duckdns.org:5505
dimascu.duckdns.org:3303
dimascu.duckdns.org:2222
dimascu.duckdns.org:6606
dimascu.duckdns.org:8808
dimascu.duckdns.org:5155
dimascu.duckdns.org:5122
dimascu.duckdns.org:8001
dimascu.duckdns.org:9000
dimascu.duckdns.org:9999
dimascu.duckdns.org:8888
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
DesbravadorUpdata.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2476-134-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2476-135-0x000000000040DD7E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1084 set thread context of 2476 1084 powershell.exe RegSvcs.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2388 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
powershell.exetaskmgr.exepid process 1084 powershell.exe 1084 powershell.exe 1084 powershell.exe 1084 powershell.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 1084 powershell.exe Token: SeDebugPrivilege 2064 taskmgr.exe Token: SeSystemProfilePrivilege 2064 taskmgr.exe Token: SeCreateGlobalPrivilege 2064 taskmgr.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
taskmgr.exepid process 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
taskmgr.exepid process 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
powershell.exedescription pid process target process PID 1084 wrote to memory of 2740 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2740 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2740 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe PID 1084 wrote to memory of 2476 1084 powershell.exe RegSvcs.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RequestTrace.ps1xml1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\e1a304418e68475e95aa6b949b45983e /t 1880 /p 23881⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-132-0x000001A6310D0000-0x000001A6310F2000-memory.dmpFilesize
136KB
-
memory/1084-133-0x00007FFC86D70000-0x00007FFC87831000-memory.dmpFilesize
10.8MB
-
memory/1084-136-0x00007FFC86D70000-0x00007FFC87831000-memory.dmpFilesize
10.8MB
-
memory/2476-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2476-135-0x000000000040DD7E-mapping.dmp