Analysis
-
max time kernel
147s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe
Resource
win7-20220901-en
General
-
Target
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe
-
Size
196KB
-
MD5
4bb78b357355de65331534be4f1c53d3
-
SHA1
a318fdbff560c4afb1ed85686578a12fd85227e0
-
SHA256
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
-
SHA512
95135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
SSDEEP
3072:vLBy3wJIadagPv77DFjbp1UG+SKGLxy9RZLhOkaOyVa3b+cmDjbd5/V/XMu:1yAJ15373Fjbp+SXxwOkPMsbz6j7Fcu
Malware Config
Extracted
asyncrat
0.5.7B
Default
mr7bashbab.ddns.net:6606
mr7bashbab.ddns.net:7707
mr7bashbab.ddns.net:8808
mr7bashbab.ddns.net:59588
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
.M.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1304-55-0x0000000000210000-0x0000000000222000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
.M.exepid process 584 .M.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 456 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 320 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exepid process 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe.M.exedescription pid process Token: SeDebugPrivilege 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe Token: SeDebugPrivilege 584 .M.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.execmd.execmd.exedescription pid process target process PID 1304 wrote to memory of 1336 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 1336 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 1336 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 1336 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 456 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 456 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 456 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 1304 wrote to memory of 456 1304 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 456 wrote to memory of 320 456 cmd.exe timeout.exe PID 456 wrote to memory of 320 456 cmd.exe timeout.exe PID 456 wrote to memory of 320 456 cmd.exe timeout.exe PID 456 wrote to memory of 320 456 cmd.exe timeout.exe PID 1336 wrote to memory of 1712 1336 cmd.exe schtasks.exe PID 1336 wrote to memory of 1712 1336 cmd.exe schtasks.exe PID 1336 wrote to memory of 1712 1336 cmd.exe schtasks.exe PID 1336 wrote to memory of 1712 1336 cmd.exe schtasks.exe PID 456 wrote to memory of 584 456 cmd.exe .M.exe PID 456 wrote to memory of 584 456 cmd.exe .M.exe PID 456 wrote to memory of 584 456 cmd.exe .M.exe PID 456 wrote to memory of 584 456 cmd.exe .M.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe"C:\Users\Admin\AppData\Local\Temp\75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn ".M" /tr '"C:\Users\Admin\AppData\Roaming\.M.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn ".M" /tr '"C:\Users\Admin\AppData\Roaming\.M.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D11.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\.M.exe"C:\Users\Admin\AppData\Roaming\.M.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3D11.tmp.batFilesize
146B
MD55fd2ca40c744853081fceea6a0abb7a7
SHA15124a45eebee3d1eeebaeee7a9fa538acbafaa3b
SHA256325baef740ca7df25f728bd41a5e45883ca40af3d6297b8ccbd2ff5f557581a9
SHA5126d5f25f98fdeccb77f2e96e9677967933cc92dc6c422194ae489080b6e21ba9bea04b3f335d0286e9a32233439b1cdb42949355e0a7a32a3f1f062203f985a48
-
C:\Users\Admin\AppData\Roaming\.M.exeFilesize
196KB
MD54bb78b357355de65331534be4f1c53d3
SHA1a318fdbff560c4afb1ed85686578a12fd85227e0
SHA25675c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
SHA51295135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
C:\Users\Admin\AppData\Roaming\.M.exeFilesize
196KB
MD54bb78b357355de65331534be4f1c53d3
SHA1a318fdbff560c4afb1ed85686578a12fd85227e0
SHA25675c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
SHA51295135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
\Users\Admin\AppData\Roaming\.M.exeFilesize
196KB
MD54bb78b357355de65331534be4f1c53d3
SHA1a318fdbff560c4afb1ed85686578a12fd85227e0
SHA25675c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
SHA51295135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
memory/320-59-0x0000000000000000-mapping.dmp
-
memory/456-57-0x0000000000000000-mapping.dmp
-
memory/584-63-0x0000000000000000-mapping.dmp
-
memory/584-65-0x0000000000DA0000-0x0000000000DA8000-memory.dmpFilesize
32KB
-
memory/1304-54-0x0000000001200000-0x0000000001208000-memory.dmpFilesize
32KB
-
memory/1304-55-0x0000000000210000-0x0000000000222000-memory.dmpFilesize
72KB
-
memory/1336-56-0x0000000000000000-mapping.dmp
-
memory/1712-60-0x0000000000000000-mapping.dmp