Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2022 13:27
Static task
static1
Behavioral task
behavioral1
Sample
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
Resource
win10v2004-20220901-en
General
-
Target
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
-
Size
87KB
-
MD5
3c6ccbfe897915f0fe6bc34d193bf4a0
-
SHA1
6fe3161ee66e317889066a302474e511220939e7
-
SHA256
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
-
SHA512
e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
SSDEEP
1536:Fn6gewiUBl7opCAFqRxzWbg5N0ns1decUmnybgR+fPUSphJ7L2Ut:0gewHgCSC0sXmbgR+fPUSphJ7Ll
Malware Config
Extracted
asyncrat
0.5.7B
System Guard Runtime
85.105.88.221:2531
System Guard Runtime
-
delay
3
-
install
false
-
install_file
System Guard Runtime
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1972-139-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\SystemGuardRuntime\\SystemGuardRuntime.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exedescription pid process target process PID 1852 set thread context of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4828 powershell.exe 4828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4828 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.execmd.exedescription pid process target process PID 1852 wrote to memory of 4828 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 1852 wrote to memory of 4828 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 1852 wrote to memory of 4828 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 1852 wrote to memory of 4316 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 1852 wrote to memory of 4316 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 1852 wrote to memory of 4316 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 4316 wrote to memory of 1052 4316 cmd.exe schtasks.exe PID 4316 wrote to memory of 1052 4316 cmd.exe schtasks.exe PID 4316 wrote to memory of 1052 4316 cmd.exe schtasks.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 1852 wrote to memory of 1972 1852 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe"C:\Users\Admin\AppData\Local\Temp\52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime' -Value '"C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-136-0x0000000000000000-mapping.dmp
-
memory/1852-133-0x0000000005550000-0x0000000005AF4000-memory.dmpFilesize
5.6MB
-
memory/1852-132-0x00000000006B0000-0x00000000006CC000-memory.dmpFilesize
112KB
-
memory/1972-138-0x0000000000000000-mapping.dmp
-
memory/1972-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4316-135-0x0000000000000000-mapping.dmp
-
memory/4828-144-0x00000000066D0000-0x00000000066EE000-memory.dmpFilesize
120KB
-
memory/4828-147-0x0000000006C90000-0x0000000006CAE000-memory.dmpFilesize
120KB
-
memory/4828-140-0x00000000059A0000-0x0000000005FC8000-memory.dmpFilesize
6.2MB
-
memory/4828-141-0x00000000057A0000-0x00000000057C2000-memory.dmpFilesize
136KB
-
memory/4828-142-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/4828-143-0x0000000006040000-0x00000000060A6000-memory.dmpFilesize
408KB
-
memory/4828-134-0x0000000000000000-mapping.dmp
-
memory/4828-145-0x0000000006CB0000-0x0000000006CE2000-memory.dmpFilesize
200KB
-
memory/4828-146-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/4828-137-0x0000000002D30000-0x0000000002D66000-memory.dmpFilesize
216KB
-
memory/4828-148-0x0000000008020000-0x000000000869A000-memory.dmpFilesize
6.5MB
-
memory/4828-149-0x00000000079E0000-0x00000000079FA000-memory.dmpFilesize
104KB
-
memory/4828-150-0x0000000007A50000-0x0000000007A5A000-memory.dmpFilesize
40KB
-
memory/4828-151-0x0000000007C60000-0x0000000007CF6000-memory.dmpFilesize
600KB
-
memory/4828-152-0x0000000007C10000-0x0000000007C1E000-memory.dmpFilesize
56KB
-
memory/4828-153-0x0000000007D20000-0x0000000007D3A000-memory.dmpFilesize
104KB
-
memory/4828-154-0x0000000007D00000-0x0000000007D08000-memory.dmpFilesize
32KB
-
memory/4828-155-0x0000000007D40000-0x0000000007D62000-memory.dmpFilesize
136KB