Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2023 05:24
Static task
static1
Behavioral task
behavioral1
Sample
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
Resource
win10v2004-20221111-en
General
-
Target
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe
-
Size
87KB
-
MD5
3c6ccbfe897915f0fe6bc34d193bf4a0
-
SHA1
6fe3161ee66e317889066a302474e511220939e7
-
SHA256
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241
-
SHA512
e0bf1fc11deacb24b5d5de4bcfc522057d1ca1b4866325356b2c9a1f009c6562eee0c0e602478b3639de4beff14997d59a3b428281d9111278544fc5e3199536
-
SSDEEP
1536:Fn6gewiUBl7opCAFqRxzWbg5N0ns1decUmnybgR+fPUSphJ7L2Ut:0gewHgCSC0sXmbgR+fPUSphJ7Ll
Malware Config
Extracted
asyncrat
0.5.7B
System Guard Runtime
85.105.88.221:2531
System Guard Runtime
-
delay
3
-
install
false
-
install_file
System Guard Runtime
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-138-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\SystemGuardRuntime\\SystemGuardRuntime.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exedescription pid process target process PID 3144 set thread context of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2116 powershell.exe 2116 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2116 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.execmd.exedescription pid process target process PID 3144 wrote to memory of 2116 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 3144 wrote to memory of 2116 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 3144 wrote to memory of 2116 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe powershell.exe PID 3144 wrote to memory of 4916 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 3144 wrote to memory of 4916 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 3144 wrote to memory of 4916 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe cmd.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 3144 wrote to memory of 4504 3144 52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe RegAsm.exe PID 4916 wrote to memory of 5028 4916 cmd.exe schtasks.exe PID 4916 wrote to memory of 5028 4916 cmd.exe schtasks.exe PID 4916 wrote to memory of 5028 4916 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe"C:\Users\Admin\AppData\Local\Temp\52bf11364e8430f4b271ebb29e2a55451543338be5b2a34e731ede58eef04241.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime' -Value '"C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-150-0x00000000076A0000-0x00000000076AA000-memory.dmpFilesize
40KB
-
memory/2116-148-0x0000000007C70000-0x00000000082EA000-memory.dmpFilesize
6.5MB
-
memory/2116-134-0x0000000000000000-mapping.dmp
-
memory/2116-143-0x0000000005CB0000-0x0000000005D16000-memory.dmpFilesize
408KB
-
memory/2116-136-0x0000000004CF0000-0x0000000004D26000-memory.dmpFilesize
216KB
-
memory/2116-154-0x0000000007940000-0x0000000007948000-memory.dmpFilesize
32KB
-
memory/2116-142-0x0000000005BD0000-0x0000000005C36000-memory.dmpFilesize
408KB
-
memory/2116-152-0x0000000007850000-0x000000000785E000-memory.dmpFilesize
56KB
-
memory/2116-140-0x0000000005370000-0x0000000005998000-memory.dmpFilesize
6.2MB
-
memory/2116-141-0x00000000052E0000-0x0000000005302000-memory.dmpFilesize
136KB
-
memory/2116-155-0x0000000007980000-0x00000000079A2000-memory.dmpFilesize
136KB
-
memory/2116-153-0x0000000007960000-0x000000000797A000-memory.dmpFilesize
104KB
-
memory/2116-146-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/2116-145-0x00000000068F0000-0x0000000006922000-memory.dmpFilesize
200KB
-
memory/2116-144-0x0000000006320000-0x000000000633E000-memory.dmpFilesize
120KB
-
memory/2116-147-0x00000000068D0000-0x00000000068EE000-memory.dmpFilesize
120KB
-
memory/2116-151-0x00000000078A0000-0x0000000007936000-memory.dmpFilesize
600KB
-
memory/2116-149-0x0000000007620000-0x000000000763A000-memory.dmpFilesize
104KB
-
memory/3144-132-0x00000000002C0000-0x00000000002DC000-memory.dmpFilesize
112KB
-
memory/3144-133-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/4504-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4504-137-0x0000000000000000-mapping.dmp
-
memory/4916-135-0x0000000000000000-mapping.dmp
-
memory/5028-139-0x0000000000000000-mapping.dmp