Analysis
-
max time kernel
73s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe
Resource
win10v2004-20221111-en
General
-
Target
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe
-
Size
1.3MB
-
MD5
1a9f14de010f2c090d00b96aedf324d0
-
SHA1
9adba3d0a2364f3c620c0f81a34963ed7c6834fe
-
SHA256
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e
-
SHA512
f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0
-
SSDEEP
6144:PZMFMoMkKpwEZofkObAUQyo9tkLnncEU8tETO8u4qNlQf9HjmaDvTK0lMONbOVrS:vhT3FRTKBO6upHPijWdT
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
millaa.publicvm.com:6606
millaa.publicvm.com:7707
millaa.publicvm.com:8808
egleynudkbe
-
delay
6
-
install
true
-
install_file
microsefto.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-55-0x0000000000370000-0x0000000000382000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
microsefto.exepid process 1804 microsefto.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1084 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 456 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exepid process 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exemicrosefto.exedescription pid process Token: SeDebugPrivilege 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe Token: SeDebugPrivilege 1804 microsefto.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.execmd.execmd.exedescription pid process target process PID 1452 wrote to memory of 980 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 980 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 980 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 980 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 1084 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 1084 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 1084 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 1452 wrote to memory of 1084 1452 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe cmd.exe PID 980 wrote to memory of 1088 980 cmd.exe schtasks.exe PID 980 wrote to memory of 1088 980 cmd.exe schtasks.exe PID 980 wrote to memory of 1088 980 cmd.exe schtasks.exe PID 980 wrote to memory of 1088 980 cmd.exe schtasks.exe PID 1084 wrote to memory of 456 1084 cmd.exe timeout.exe PID 1084 wrote to memory of 456 1084 cmd.exe timeout.exe PID 1084 wrote to memory of 456 1084 cmd.exe timeout.exe PID 1084 wrote to memory of 456 1084 cmd.exe timeout.exe PID 1084 wrote to memory of 1804 1084 cmd.exe microsefto.exe PID 1084 wrote to memory of 1804 1084 cmd.exe microsefto.exe PID 1084 wrote to memory of 1804 1084 cmd.exe microsefto.exe PID 1084 wrote to memory of 1804 1084 cmd.exe microsefto.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe"C:\Users\Admin\AppData\Local\Temp\9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e /tr '"C:\Users\Admin\AppData\Roaming\microsefto.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 9eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e /tr '"C:\Users\Admin\AppData\Roaming\microsefto.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD2CA.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\microsefto.exe"C:\Users\Admin\AppData\Roaming\microsefto.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD2CA.tmp.batFilesize
154B
MD5cbadbd8a2c2b43b7b1518601e1ffbf29
SHA17351671a9ee21715a96c54e802eefc62a8099ba5
SHA2562dabfd757a024857991276fbbad1381708da23bf4bd4887572e3045f0ec7d76e
SHA512902505a1a5418dd6c64576e4339f63bbcf37267e2016fc0527b5f7891780a82ae4d060a4676ef1d6676b64cead2988830344353fe3201b892f30a7e4577dfb54
-
C:\Users\Admin\AppData\Roaming\microsefto.exeFilesize
1.3MB
MD51a9f14de010f2c090d00b96aedf324d0
SHA19adba3d0a2364f3c620c0f81a34963ed7c6834fe
SHA2569eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e
SHA512f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0
-
C:\Users\Admin\AppData\Roaming\microsefto.exeFilesize
1.3MB
MD51a9f14de010f2c090d00b96aedf324d0
SHA19adba3d0a2364f3c620c0f81a34963ed7c6834fe
SHA2569eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e
SHA512f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0
-
\Users\Admin\AppData\Roaming\microsefto.exeFilesize
1.3MB
MD51a9f14de010f2c090d00b96aedf324d0
SHA19adba3d0a2364f3c620c0f81a34963ed7c6834fe
SHA2569eb30672961f46f8d28675af6a07dfdd3e07c2ce955ec0f135ead8475195b61e
SHA512f57220a84f920c546b9cbb71a0055dd295ea3fb03994cccc30927c8640c55797ded4e5008e16699a6eb2521d6be4bc36117e3a2bab59436f9c597a3e457624e0
-
memory/456-61-0x0000000000000000-mapping.dmp
-
memory/980-57-0x0000000000000000-mapping.dmp
-
memory/1084-58-0x0000000000000000-mapping.dmp
-
memory/1088-59-0x0000000000000000-mapping.dmp
-
memory/1452-56-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1452-55-0x0000000000370000-0x0000000000382000-memory.dmpFilesize
72KB
-
memory/1452-54-0x00000000009C0000-0x0000000000B18000-memory.dmpFilesize
1.3MB
-
memory/1804-64-0x0000000000000000-mapping.dmp
-
memory/1804-66-0x0000000000E80000-0x0000000000FD8000-memory.dmpFilesize
1.3MB