Analysis
-
max time kernel
150s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 17:08
General
-
Target
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe
-
Size
47KB
-
MD5
a085750ab9332bd2f0ad4b14ceba4c8f
-
SHA1
ceb4652807226f27eb9556e2f2c9fd080aa341d8
-
SHA256
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca
-
SHA512
ad4daed223c00083e6dc0ecaeb2367a0e37d62a26a887be43a523aa6cfbd5e5ed8a740dee69c08b853abb85c9c53ecfa59d3cc2f8266d6a5addfbb5c2bb557f7
-
SSDEEP
768:Bu449TxAwVDWUPOvG6yxmo2qbNDwuNKKKlePIvmp40b+AQXaTPva2CznH3xBDZox:Bu449Tx72vGR2wEuuVu9b+AQarrC7Pda
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:51115
127.0.0.1:26993
185.246.220.26:6606
185.246.220.26:7707
185.246.220.26:8808
185.246.220.26:51115
185.246.220.26:26993
5.tcp.ngrok.io:6606
5.tcp.ngrok.io:7707
5.tcp.ngrok.io:8808
5.tcp.ngrok.io:51115
5.tcp.ngrok.io:26993
disownnet.duckdns.org:6606
disownnet.duckdns.org:7707
disownnet.duckdns.org:8808
disownnet.duckdns.org:51115
disownnet.duckdns.org:26993
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
services.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4556-132-0x0000000000EE0000-0x0000000000EF2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\services.exe asyncrat C:\Users\Admin\AppData\Roaming\services.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 5052 services.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2492 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exepid process 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exeservices.exedescription pid process Token: SeDebugPrivilege 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe Token: SeDebugPrivilege 5052 services.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.execmd.execmd.exedescription pid process target process PID 4556 wrote to memory of 4632 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4556 wrote to memory of 4632 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4556 wrote to memory of 4632 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4556 wrote to memory of 2216 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4556 wrote to memory of 2216 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4556 wrote to memory of 2216 4556 ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe cmd.exe PID 4632 wrote to memory of 2732 4632 cmd.exe schtasks.exe PID 4632 wrote to memory of 2732 4632 cmd.exe schtasks.exe PID 4632 wrote to memory of 2732 4632 cmd.exe schtasks.exe PID 2216 wrote to memory of 2492 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 2492 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 2492 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 5052 2216 cmd.exe services.exe PID 2216 wrote to memory of 5052 2216 cmd.exe services.exe PID 2216 wrote to memory of 5052 2216 cmd.exe services.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe"C:\Users\Admin\AppData\Local\Temp\ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr '"C:\Users\Admin\AppData\Roaming\services.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services" /tr '"C:\Users\Admin\AppData\Roaming\services.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF784.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\services.exe"C:\Users\Admin\AppData\Roaming\services.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF784.tmp.batFilesize
152B
MD53510f4932cb8bf542794d7e3961a1f81
SHA185a2926dbbf7c00c279f93eb09528c7c21f94f4f
SHA25634f1e994b4b399dae52c2ac8027a49b7db944b42def6c70962b414eb4ed652ed
SHA51291312b01acd7ccd91967ca2e927ac7b4eafd5d5ed338c8b14fde19cacec47cce2f94644211361f15880dae82f0b51d851537b70729214b458a9724bf460351e8
-
C:\Users\Admin\AppData\Roaming\services.exeFilesize
47KB
MD5a085750ab9332bd2f0ad4b14ceba4c8f
SHA1ceb4652807226f27eb9556e2f2c9fd080aa341d8
SHA256ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca
SHA512ad4daed223c00083e6dc0ecaeb2367a0e37d62a26a887be43a523aa6cfbd5e5ed8a740dee69c08b853abb85c9c53ecfa59d3cc2f8266d6a5addfbb5c2bb557f7
-
C:\Users\Admin\AppData\Roaming\services.exeFilesize
47KB
MD5a085750ab9332bd2f0ad4b14ceba4c8f
SHA1ceb4652807226f27eb9556e2f2c9fd080aa341d8
SHA256ceb08316d1560c7c4f5b6b8b8209b98230fe95480b3a3905d841b313d49216ca
SHA512ad4daed223c00083e6dc0ecaeb2367a0e37d62a26a887be43a523aa6cfbd5e5ed8a740dee69c08b853abb85c9c53ecfa59d3cc2f8266d6a5addfbb5c2bb557f7
-
memory/2216-135-0x0000000000000000-mapping.dmp
-
memory/2492-138-0x0000000000000000-mapping.dmp
-
memory/2732-137-0x0000000000000000-mapping.dmp
-
memory/4556-132-0x0000000000EE0000-0x0000000000EF2000-memory.dmpFilesize
72KB
-
memory/4556-133-0x00000000059A0000-0x0000000005A3C000-memory.dmpFilesize
624KB
-
memory/4632-134-0x0000000000000000-mapping.dmp
-
memory/5052-139-0x0000000000000000-mapping.dmp