Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 19:05
Static task
static1
Behavioral task
behavioral1
Sample
9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe
Resource
win10v2004-20220812-en
General
-
Target
9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe
-
Size
87KB
-
MD5
1ac438d233f333474b959f8c0cb719af
-
SHA1
9e64e2e4c3f295829a57810853a112b567209301
-
SHA256
9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766
-
SHA512
c5fb1dcf19be5dd5f1526b5a3572ae7fbd7efe63453cb7b5babd7d494d48b8c264d0c302658976a50b1b8d2f52874765631d6b9b64f5f1903bf674af81ca3990
-
SSDEEP
1536:7UZggBc01k4Br4bk4OAsZ08PL4IBQF7EiMsf617xIatwIavbgoeaZ91x2uta:7UigBMRbBi/MGQF7EiMe6xZtqbgoeY9s
Malware Config
Extracted
asyncrat
0.5.7B
SecurityHealthSeurvice
217.64.31.3:8437
SecurityHealthSeurvice
-
delay
3
-
install
false
-
install_file
SecurityHealthSeurvice.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1164-139-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSeurvic = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSeurvic\\SecurityHealthSeurvic.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exedescription pid process target process PID 1556 set thread context of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3448 powershell.exe 3448 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3448 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.execmd.exedescription pid process target process PID 1556 wrote to memory of 3448 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe powershell.exe PID 1556 wrote to memory of 3448 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe powershell.exe PID 1556 wrote to memory of 3448 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe powershell.exe PID 1556 wrote to memory of 3768 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe cmd.exe PID 1556 wrote to memory of 3768 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe cmd.exe PID 1556 wrote to memory of 3768 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe cmd.exe PID 3768 wrote to memory of 532 3768 cmd.exe schtasks.exe PID 3768 wrote to memory of 532 3768 cmd.exe schtasks.exe PID 3768 wrote to memory of 532 3768 cmd.exe schtasks.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe PID 1556 wrote to memory of 1164 1556 9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe"C:\Users\Admin\AppData\Local\Temp\9ce4aff682a4faa9c09793f5a0f09db075786fe2d3098acf7553c62df22fa766.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthSeurvic';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthSeurvic' -Value '"C:\Users\Admin\AppData\Roaming\SecurityHealthSeurvic\SecurityHealthSeurvic.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SecurityHealthSeurvic /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSeurvic\SecurityHealthSeurvic.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SecurityHealthSeurvic /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSeurvic\SecurityHealthSeurvic.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-136-0x0000000000000000-mapping.dmp
-
memory/1164-138-0x0000000000000000-mapping.dmp
-
memory/1164-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1556-133-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB
-
memory/1556-132-0x0000000000950000-0x000000000096C000-memory.dmpFilesize
112KB
-
memory/3448-144-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/3448-146-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/3448-155-0x0000000007920000-0x0000000007942000-memory.dmpFilesize
136KB
-
memory/3448-140-0x00000000053F0000-0x0000000005A18000-memory.dmpFilesize
6.2MB
-
memory/3448-141-0x0000000005260000-0x0000000005282000-memory.dmpFilesize
136KB
-
memory/3448-142-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/3448-143-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/3448-134-0x0000000000000000-mapping.dmp
-
memory/3448-145-0x0000000006890000-0x00000000068C2000-memory.dmpFilesize
200KB
-
memory/3448-137-0x0000000002900000-0x0000000002936000-memory.dmpFilesize
216KB
-
memory/3448-147-0x0000000006850000-0x000000000686E000-memory.dmpFilesize
120KB
-
memory/3448-148-0x0000000007C40000-0x00000000082BA000-memory.dmpFilesize
6.5MB
-
memory/3448-149-0x00000000075E0000-0x00000000075FA000-memory.dmpFilesize
104KB
-
memory/3448-150-0x0000000007630000-0x000000000763A000-memory.dmpFilesize
40KB
-
memory/3448-151-0x0000000007840000-0x00000000078D6000-memory.dmpFilesize
600KB
-
memory/3448-152-0x00000000077F0000-0x00000000077FE000-memory.dmpFilesize
56KB
-
memory/3448-153-0x0000000007900000-0x000000000791A000-memory.dmpFilesize
104KB
-
memory/3448-154-0x00000000078E0000-0x00000000078E8000-memory.dmpFilesize
32KB
-
memory/3768-135-0x0000000000000000-mapping.dmp