Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2023 13:54
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
45KB
-
MD5
c19b1914fdfb5f4dc77afef42e967909
-
SHA1
49436764140a7bfcd332bc91ca141706d0519a88
-
SHA256
6ea95e85a279f9f842504b80c85ec920aeaefab99ebc377709a1f4317929ccef
-
SHA512
8c26d71bd1c3b991446b7b7d1ec7ca995aeaf1c5a4e49af4f8b2c9b0cbe8f37f1b97b517899ab530d64a2a0111aafa12c631904c958ebc688fa2bcee0b8078e3
-
SSDEEP
768:Zu1a71T3EiJfWUzuydmo2qzDKjGKG6PIyzjbFgX3i3w0HpLofac5BDZgjS:Zu1a71T3xN2SKYDy3bCXS3/HpUagdiS
Malware Config
Extracted
asyncrat
0.5.7B
Default
TestM6SI8Ok23k
-
delay
3
-
install
true
-
install_file
Nvidia.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/WxVJqvSS
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5068-132-0x0000000000530000-0x0000000000542000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Nvidia.exe asyncrat C:\Users\Admin\AppData\Roaming\Nvidia.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Nvidia.exepid process 1564 Nvidia.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation file.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3424 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
file.exepid process 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe 5068 file.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file.exeNvidia.exedescription pid process Token: SeDebugPrivilege 5068 file.exe Token: SeDebugPrivilege 1564 Nvidia.exe Token: SeDebugPrivilege 1564 Nvidia.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.execmd.execmd.exedescription pid process target process PID 5068 wrote to memory of 2748 5068 file.exe cmd.exe PID 5068 wrote to memory of 2748 5068 file.exe cmd.exe PID 5068 wrote to memory of 2748 5068 file.exe cmd.exe PID 5068 wrote to memory of 1492 5068 file.exe cmd.exe PID 5068 wrote to memory of 1492 5068 file.exe cmd.exe PID 5068 wrote to memory of 1492 5068 file.exe cmd.exe PID 2748 wrote to memory of 1700 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 1700 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 1700 2748 cmd.exe schtasks.exe PID 1492 wrote to memory of 3424 1492 cmd.exe timeout.exe PID 1492 wrote to memory of 3424 1492 cmd.exe timeout.exe PID 1492 wrote to memory of 3424 1492 cmd.exe timeout.exe PID 1492 wrote to memory of 1564 1492 cmd.exe Nvidia.exe PID 1492 wrote to memory of 1564 1492 cmd.exe Nvidia.exe PID 1492 wrote to memory of 1564 1492 cmd.exe Nvidia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Nvidia" /tr '"C:\Users\Admin\AppData\Roaming\Nvidia.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Nvidia" /tr '"C:\Users\Admin\AppData\Roaming\Nvidia.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC846.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Nvidia.exe"C:\Users\Admin\AppData\Roaming\Nvidia.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC846.tmp.batFilesize
150B
MD594a8e8b939e17d996ca32078f27fa3d1
SHA1985a68299bfc3750ddccde4adfa733efd273eceb
SHA2563e49bca06590cf7d1edf3fd8fff34bf42339c64091a7355d49fde9dc5420305c
SHA512b45d888092fbab6b134e97a8d3a23e84e33e0b50f198607e7c582a7b9577fd66998196159475ba8a3f2eedbfa7d154787cb536d772ab176c4defe50f24359e63
-
C:\Users\Admin\AppData\Roaming\Nvidia.exeFilesize
45KB
MD5c19b1914fdfb5f4dc77afef42e967909
SHA149436764140a7bfcd332bc91ca141706d0519a88
SHA2566ea95e85a279f9f842504b80c85ec920aeaefab99ebc377709a1f4317929ccef
SHA5128c26d71bd1c3b991446b7b7d1ec7ca995aeaf1c5a4e49af4f8b2c9b0cbe8f37f1b97b517899ab530d64a2a0111aafa12c631904c958ebc688fa2bcee0b8078e3
-
C:\Users\Admin\AppData\Roaming\Nvidia.exeFilesize
45KB
MD5c19b1914fdfb5f4dc77afef42e967909
SHA149436764140a7bfcd332bc91ca141706d0519a88
SHA2566ea95e85a279f9f842504b80c85ec920aeaefab99ebc377709a1f4317929ccef
SHA5128c26d71bd1c3b991446b7b7d1ec7ca995aeaf1c5a4e49af4f8b2c9b0cbe8f37f1b97b517899ab530d64a2a0111aafa12c631904c958ebc688fa2bcee0b8078e3
-
memory/1492-136-0x0000000000000000-mapping.dmp
-
memory/1564-140-0x0000000000000000-mapping.dmp
-
memory/1700-137-0x0000000000000000-mapping.dmp
-
memory/2748-135-0x0000000000000000-mapping.dmp
-
memory/3424-139-0x0000000000000000-mapping.dmp
-
memory/5068-132-0x0000000000530000-0x0000000000542000-memory.dmpFilesize
72KB
-
memory/5068-133-0x0000000004EC0000-0x0000000004F26000-memory.dmpFilesize
408KB
-
memory/5068-134-0x0000000005310000-0x00000000053AC000-memory.dmpFilesize
624KB