Analysis
-
max time kernel
93s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe
Resource
win7-20220812-en
General
-
Target
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe
-
Size
623KB
-
MD5
7c96849ae4903afd6f8d853458cb1f59
-
SHA1
961806408c4be9d2d826b0665cba46e86dfc5c6a
-
SHA256
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb
-
SHA512
18f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd
-
SSDEEP
12288:0JM7K/6xFVdY/r29tDIVmz/Oee0F0q5jGLH6+usB:uXCxFVdY68VE/OX0RFCHa8
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:59588
127.0.0.1:8808
mr7bashbab.ddns.net:6606
mr7bashbab.ddns.net:7707
mr7bashbab.ddns.net:59588
mr7bashbab.ddns.net:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
System.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-55-0x00000000004F0000-0x000000000051A000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
System.exepid process 1340 System.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2000 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 556 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exepid process 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exedescription pid process Token: SeDebugPrivilege 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.execmd.execmd.exedescription pid process target process PID 1952 wrote to memory of 816 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 816 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 816 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 816 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 2000 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 2000 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 2000 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 1952 wrote to memory of 2000 1952 99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe cmd.exe PID 816 wrote to memory of 1632 816 cmd.exe schtasks.exe PID 816 wrote to memory of 1632 816 cmd.exe schtasks.exe PID 816 wrote to memory of 1632 816 cmd.exe schtasks.exe PID 816 wrote to memory of 1632 816 cmd.exe schtasks.exe PID 2000 wrote to memory of 556 2000 cmd.exe timeout.exe PID 2000 wrote to memory of 556 2000 cmd.exe timeout.exe PID 2000 wrote to memory of 556 2000 cmd.exe timeout.exe PID 2000 wrote to memory of 556 2000 cmd.exe timeout.exe PID 2000 wrote to memory of 1340 2000 cmd.exe System.exe PID 2000 wrote to memory of 1340 2000 cmd.exe System.exe PID 2000 wrote to memory of 1340 2000 cmd.exe System.exe PID 2000 wrote to memory of 1340 2000 cmd.exe System.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe"C:\Users\Admin\AppData\Local\Temp\99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp56A9.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\System.exe"C:\Users\Admin\AppData\Roaming\System.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp56A9.tmp.batFilesize
150B
MD5477efdb13e2aae10253a3630002f294b
SHA192fd9125bd5a33ce554236fefa2fec576d661fe8
SHA2567ba3d38b195e341bba8605c0c2ed0e8dab57587388ca458f7b7dbd37db5f88d4
SHA51280c2b18537c5a510a87ada74fa3ff18bc33f1e63eda87afe972f17d938c07298e24831f4cc13398182fdfcfaa6296f5507ab1a5c71b45b7ccee3a40d30643273
-
C:\Users\Admin\AppData\Roaming\System.exeFilesize
623KB
MD57c96849ae4903afd6f8d853458cb1f59
SHA1961806408c4be9d2d826b0665cba46e86dfc5c6a
SHA25699ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb
SHA51218f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd
-
C:\Users\Admin\AppData\Roaming\System.exeFilesize
623KB
MD57c96849ae4903afd6f8d853458cb1f59
SHA1961806408c4be9d2d826b0665cba46e86dfc5c6a
SHA25699ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb
SHA51218f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd
-
\Users\Admin\AppData\Roaming\System.exeFilesize
623KB
MD57c96849ae4903afd6f8d853458cb1f59
SHA1961806408c4be9d2d826b0665cba46e86dfc5c6a
SHA25699ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb
SHA51218f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd
-
memory/556-60-0x0000000000000000-mapping.dmp
-
memory/816-56-0x0000000000000000-mapping.dmp
-
memory/1340-63-0x0000000000000000-mapping.dmp
-
memory/1340-65-0x00000000008E0000-0x00000000008F0000-memory.dmpFilesize
64KB
-
memory/1632-58-0x0000000000000000-mapping.dmp
-
memory/1952-54-0x0000000000F10000-0x0000000000F20000-memory.dmpFilesize
64KB
-
memory/1952-55-0x00000000004F0000-0x000000000051A000-memory.dmpFilesize
168KB
-
memory/2000-57-0x0000000000000000-mapping.dmp