Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe
Resource
win7-20220901-en
General
-
Target
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe
-
Size
315KB
-
MD5
42ffde5af3d66024c0699f14922bb1da
-
SHA1
b4019d8834f565877ead605a6930e5fdb1bdcfa1
-
SHA256
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269
-
SHA512
cef54ced9dd019f24cd8619e3fd989a8ca146680ffb9b98217941068d79c26a38476d696d2a6c91c69fde70e3b8f25f05c18462682b26486f693c16badcd82fe
-
SSDEEP
6144:D6xqzHOWLMGBgPcpdrVVsqy3WmSNRbNqfWvC:OxqzHOM/HVVs/3WNbMfWvC
Malware Config
Extracted
asyncrat
0.5.7B
Default
40.75.8.74:7707
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7A
Default
23.102.129.234:7707
uvkcjjugzqls
-
delay
1
-
install
false
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Cuubz.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Cuubz.exe asyncrat behavioral2/memory/4468-140-0x0000000000140000-0x0000000000152000-memory.dmp asyncrat C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exe asyncrat behavioral2/memory/1648-144-0x0000000000A40000-0x0000000000A52000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Cuubz.exeIzkemwkdhqej.exepid process 4468 Cuubz.exe 1648 Izkemwkdhqej.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exedescription pid process Token: SeDebugPrivilege 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exedescription pid process target process PID 4684 wrote to memory of 4468 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Cuubz.exe PID 4684 wrote to memory of 4468 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Cuubz.exe PID 4684 wrote to memory of 4468 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Cuubz.exe PID 4684 wrote to memory of 1648 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Izkemwkdhqej.exe PID 4684 wrote to memory of 1648 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Izkemwkdhqej.exe PID 4684 wrote to memory of 1648 4684 9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe Izkemwkdhqej.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe"C:\Users\Admin\AppData\Local\Temp\9b608fcfcff20713072deb68b58dd218cc10f880b5c85a7903aec99d9471f269.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cuubz.exe"C:\Users\Admin\AppData\Local\Temp\Cuubz.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exe"C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cuubz.exeFilesize
47KB
MD596073281c86416ec2a530a8e21431cac
SHA13760599c3ad5c487fdd0d67feed2d3527769d2a0
SHA256e2966044f7a5771d7cae9b568d50672be4067be8e547382dbec13edc94e1e994
SHA512aab5c5dfc7a1b5115231cde88291a4e8873edc7f79d5278465e15e0ccb5b44adb18dfef06d34bd78f88200b8380fcb3eccc571a2c5db2a8924071745a8524317
-
C:\Users\Admin\AppData\Local\Temp\Cuubz.exeFilesize
47KB
MD596073281c86416ec2a530a8e21431cac
SHA13760599c3ad5c487fdd0d67feed2d3527769d2a0
SHA256e2966044f7a5771d7cae9b568d50672be4067be8e547382dbec13edc94e1e994
SHA512aab5c5dfc7a1b5115231cde88291a4e8873edc7f79d5278465e15e0ccb5b44adb18dfef06d34bd78f88200b8380fcb3eccc571a2c5db2a8924071745a8524317
-
C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exeFilesize
49KB
MD5955fec4f0483cf02565ceba73ca2456d
SHA193aa63dace4f41464b9fa7c2950635f2cd2bc4b4
SHA25687db4d2962807c84b27c1c759abb7744e01685be2e7fdda54e95fc502057491e
SHA5124db6d3ba9492fcdb74c276a3cb46c158a6bbb153532a25210a7d11166403a2aaf1127b6445768106821586f46934ac0a3e60894c554767fdf604cae25b63766d
-
C:\Users\Admin\AppData\Local\Temp\Izkemwkdhqej.exeFilesize
49KB
MD5955fec4f0483cf02565ceba73ca2456d
SHA193aa63dace4f41464b9fa7c2950635f2cd2bc4b4
SHA25687db4d2962807c84b27c1c759abb7744e01685be2e7fdda54e95fc502057491e
SHA5124db6d3ba9492fcdb74c276a3cb46c158a6bbb153532a25210a7d11166403a2aaf1127b6445768106821586f46934ac0a3e60894c554767fdf604cae25b63766d
-
memory/1648-141-0x0000000000000000-mapping.dmp
-
memory/1648-144-0x0000000000A40000-0x0000000000A52000-memory.dmpFilesize
72KB
-
memory/4468-137-0x0000000000000000-mapping.dmp
-
memory/4468-140-0x0000000000140000-0x0000000000152000-memory.dmpFilesize
72KB
-
memory/4684-136-0x0000000004B80000-0x0000000004B8A000-memory.dmpFilesize
40KB
-
memory/4684-135-0x0000000004D60000-0x0000000004DF2000-memory.dmpFilesize
584KB
-
memory/4684-132-0x0000000000110000-0x0000000000166000-memory.dmpFilesize
344KB
-
memory/4684-134-0x0000000005270000-0x0000000005814000-memory.dmpFilesize
5.6MB
-
memory/4684-133-0x0000000004C00000-0x0000000004C9C000-memory.dmpFilesize
624KB