Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2023 11:46
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
47KB
-
MD5
711fbd6412e3030d4653a05883fcd498
-
SHA1
f1c2a454140c5e4df310643c6e5ee21e50373904
-
SHA256
53e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
-
SHA512
fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
SSDEEP
768:yuiHNTdFHLBWUZiGrmo2qrKkb6uKEKqPICRPCC7RB80byrwG+a1ZlgVrZiBDZUx:yuiHNTdBR2tkcTCRPznbyrh+a1U5ZcdW
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:8888
127.0.0.1:53370
flingmodder-53370.portmap.io:6606
flingmodder-53370.portmap.io:7707
flingmodder-53370.portmap.io:8808
flingmodder-53370.portmap.io:8888
flingmodder-53370.portmap.io:53370
Admin
-
delay
3
-
install
true
-
install_file
Windows.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-132-0x0000000000580000-0x0000000000592000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Windows.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid process 2200 Windows.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4376 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
tmp.exepid process 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe 4872 tmp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exeWindows.exedescription pid process Token: SeDebugPrivilege 4872 tmp.exe Token: SeDebugPrivilege 2200 Windows.exe Token: SeDebugPrivilege 2200 Windows.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.execmd.execmd.exedescription pid process target process PID 4872 wrote to memory of 756 4872 tmp.exe cmd.exe PID 4872 wrote to memory of 756 4872 tmp.exe cmd.exe PID 4872 wrote to memory of 756 4872 tmp.exe cmd.exe PID 4872 wrote to memory of 4664 4872 tmp.exe cmd.exe PID 4872 wrote to memory of 4664 4872 tmp.exe cmd.exe PID 4872 wrote to memory of 4664 4872 tmp.exe cmd.exe PID 756 wrote to memory of 4660 756 cmd.exe schtasks.exe PID 756 wrote to memory of 4660 756 cmd.exe schtasks.exe PID 756 wrote to memory of 4660 756 cmd.exe schtasks.exe PID 4664 wrote to memory of 4376 4664 cmd.exe timeout.exe PID 4664 wrote to memory of 4376 4664 cmd.exe timeout.exe PID 4664 wrote to memory of 4376 4664 cmd.exe timeout.exe PID 4664 wrote to memory of 2200 4664 cmd.exe Windows.exe PID 4664 wrote to memory of 2200 4664 cmd.exe Windows.exe PID 4664 wrote to memory of 2200 4664 cmd.exe Windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp73BE.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows.exe"C:\Users\Admin\AppData\Roaming\Windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp73BE.tmp.batFilesize
151B
MD5bfae38535741ccdbd3bd86aaa92e7eb6
SHA18231391c27bb6b5b33114e61a7254fe04088c9e6
SHA256594addc22dd1e943ba0d83c6cba4753eecba752a61cc5d4e7b24fc2f3c1f7581
SHA51259029e3bf3d4e915ea122a16c7494bac025c04515a34c270f4abb478ac61edd25ffd480a297ee050776949b7ad1cddae53d47bee7228b9f6a5f7b164a69c6524
-
C:\Users\Admin\AppData\Roaming\Windows.exeFilesize
47KB
MD5711fbd6412e3030d4653a05883fcd498
SHA1f1c2a454140c5e4df310643c6e5ee21e50373904
SHA25653e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
SHA512fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
C:\Users\Admin\AppData\Roaming\Windows.exeFilesize
47KB
MD5711fbd6412e3030d4653a05883fcd498
SHA1f1c2a454140c5e4df310643c6e5ee21e50373904
SHA25653e43388c51de2879429ef05b1ac8a636024f419a9f9d56d7afabf104db721aa
SHA512fe2de1c3c52b5afa5d11b27c3d7944b9cd6fcba6cfbc9404bd37e94b64f610906ed3ad75d04c7bbe2f235d87a8f9703aa6bebcd896f994e54eb70a0f2139294c
-
memory/756-135-0x0000000000000000-mapping.dmp
-
memory/2200-140-0x0000000000000000-mapping.dmp
-
memory/4376-139-0x0000000000000000-mapping.dmp
-
memory/4660-138-0x0000000000000000-mapping.dmp
-
memory/4664-136-0x0000000000000000-mapping.dmp
-
memory/4872-132-0x0000000000580000-0x0000000000592000-memory.dmpFilesize
72KB
-
memory/4872-133-0x0000000005230000-0x0000000005296000-memory.dmpFilesize
408KB
-
memory/4872-134-0x0000000005670000-0x000000000570C000-memory.dmpFilesize
624KB