Analysis
-
max time kernel
148s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:29
Static task
static1
Behavioral task
behavioral1
Sample
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe
Resource
win7-20220812-en
General
-
Target
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe
-
Size
196KB
-
MD5
035de7c27c7be916b5f3320e895c61ac
-
SHA1
84159edae207759230fdc0ffebc46a54acf73e98
-
SHA256
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2
-
SHA512
aea1b617fd2441eb73ada7fcd2b75255bb6b764837d6adf962adbe460a5060a19a3d0c98ce819b2711720bf9dc9c4c9cd67d88f81727d5ecec64be3bd40a3560
-
SSDEEP
6144:bzWJFc3d3B6Nt53jrSrKZLehQS/xvlZ6/:663B6Nt53n6Q4Vg
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
mr7bashbab.ddns.net:6606
mr7bashbab.ddns.net:7707
mr7bashbab.ddns.net:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
OBS.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/964-55-0x0000000000250000-0x0000000000262000-memory.dmp asyncrat behavioral1/memory/2032-66-0x0000000000240000-0x0000000000252000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
OBS.exepid process 2032 OBS.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 948 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1204 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exepid process 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exeOBS.exedescription pid process Token: SeDebugPrivilege 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe Token: SeDebugPrivilege 2032 OBS.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.execmd.execmd.exedescription pid process target process PID 964 wrote to memory of 988 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 988 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 988 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 988 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 948 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 948 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 948 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 964 wrote to memory of 948 964 26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe cmd.exe PID 948 wrote to memory of 1204 948 cmd.exe timeout.exe PID 948 wrote to memory of 1204 948 cmd.exe timeout.exe PID 948 wrote to memory of 1204 948 cmd.exe timeout.exe PID 948 wrote to memory of 1204 948 cmd.exe timeout.exe PID 988 wrote to memory of 1068 988 cmd.exe schtasks.exe PID 988 wrote to memory of 1068 988 cmd.exe schtasks.exe PID 988 wrote to memory of 1068 988 cmd.exe schtasks.exe PID 988 wrote to memory of 1068 988 cmd.exe schtasks.exe PID 948 wrote to memory of 2032 948 cmd.exe OBS.exe PID 948 wrote to memory of 2032 948 cmd.exe OBS.exe PID 948 wrote to memory of 2032 948 cmd.exe OBS.exe PID 948 wrote to memory of 2032 948 cmd.exe OBS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe"C:\Users\Admin\AppData\Local\Temp\26e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\OBS.exe"C:\Users\Admin\AppData\Roaming\OBS.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8279.tmp.batFilesize
147B
MD51275a8eb3089384549c84fdb3df7f101
SHA1d6be262440e8a40bdc5f2d1b30560a0a66673924
SHA256a029dc3b702eae5b287a6b51be75c86b5975fcf35931927c1a4fb93d59f75294
SHA5124c32777de57a3779896557d562c06ffbe78923c76fe50a146ee208447f82df6ec55d585a27984d7b5cee88b2d44cf4df36343c24ab37fe2230762f346e4785ac
-
C:\Users\Admin\AppData\Roaming\OBS.exeFilesize
196KB
MD5035de7c27c7be916b5f3320e895c61ac
SHA184159edae207759230fdc0ffebc46a54acf73e98
SHA25626e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2
SHA512aea1b617fd2441eb73ada7fcd2b75255bb6b764837d6adf962adbe460a5060a19a3d0c98ce819b2711720bf9dc9c4c9cd67d88f81727d5ecec64be3bd40a3560
-
C:\Users\Admin\AppData\Roaming\OBS.exeFilesize
196KB
MD5035de7c27c7be916b5f3320e895c61ac
SHA184159edae207759230fdc0ffebc46a54acf73e98
SHA25626e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2
SHA512aea1b617fd2441eb73ada7fcd2b75255bb6b764837d6adf962adbe460a5060a19a3d0c98ce819b2711720bf9dc9c4c9cd67d88f81727d5ecec64be3bd40a3560
-
\Users\Admin\AppData\Roaming\OBS.exeFilesize
196KB
MD5035de7c27c7be916b5f3320e895c61ac
SHA184159edae207759230fdc0ffebc46a54acf73e98
SHA25626e657df0e518cad1107765e55ffa3af3dd71a3c70b07ce69c31f7ebaaa145b2
SHA512aea1b617fd2441eb73ada7fcd2b75255bb6b764837d6adf962adbe460a5060a19a3d0c98ce819b2711720bf9dc9c4c9cd67d88f81727d5ecec64be3bd40a3560
-
memory/948-57-0x0000000000000000-mapping.dmp
-
memory/964-54-0x0000000000980000-0x0000000000988000-memory.dmpFilesize
32KB
-
memory/964-55-0x0000000000250000-0x0000000000262000-memory.dmpFilesize
72KB
-
memory/988-56-0x0000000000000000-mapping.dmp
-
memory/1068-60-0x0000000000000000-mapping.dmp
-
memory/1204-59-0x0000000000000000-mapping.dmp
-
memory/2032-63-0x0000000000000000-mapping.dmp
-
memory/2032-65-0x0000000000F30000-0x0000000000F38000-memory.dmpFilesize
32KB
-
memory/2032-66-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB