Analysis
-
max time kernel
149s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe
Resource
win7-20221111-en
General
-
Target
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe
-
Size
195KB
-
MD5
66a167b944c4ea45a207f551e2c9fc28
-
SHA1
88703c2bf165899ec004dab9f5f273c46a8d286c
-
SHA256
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38
-
SHA512
89d647f0593518fa63976e168588c41bacd91bd6be59550e535a27ca7d817f29705830ce5ad3810a76096934d66216afb3f4f670309c102f1f4c496027969370
-
SSDEEP
1536:hu0Fi41HYlZuIyPGSRfxp6kghBtdhv/oOK5XjJwkA1MmnQTNSbgjxAAnieghr4Dq:huTnaYfshPPD74Jo50093FFd7GEawuJ
Malware Config
Extracted
asyncrat
0.5.7B
Default
ValentinMihai-48225.portmap.io:48225=>7119:48225
ValentinMihai-48225.portmap.io:48225=>7119:7119
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Windows Defender SmartScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\build.exe asyncrat C:\Users\Admin\AppData\Local\build.exe asyncrat behavioral1/memory/876-58-0x0000000000B90000-0x0000000000BA2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe asyncrat behavioral1/memory/1632-69-0x0000000001330000-0x0000000001342000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
build.exeWindows Defender SmartScreen.exepid process 876 build.exe 1632 Windows Defender SmartScreen.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1172 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
build.exepid process 876 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exeWindows Defender SmartScreen.exedescription pid process Token: SeDebugPrivilege 876 build.exe Token: SeDebugPrivilege 1632 Windows Defender SmartScreen.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exebuild.execmd.execmd.exedescription pid process target process PID 956 wrote to memory of 876 956 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 956 wrote to memory of 876 956 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 956 wrote to memory of 876 956 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 956 wrote to memory of 876 956 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 876 wrote to memory of 1940 876 build.exe cmd.exe PID 876 wrote to memory of 1940 876 build.exe cmd.exe PID 876 wrote to memory of 1940 876 build.exe cmd.exe PID 876 wrote to memory of 1940 876 build.exe cmd.exe PID 876 wrote to memory of 1172 876 build.exe cmd.exe PID 876 wrote to memory of 1172 876 build.exe cmd.exe PID 876 wrote to memory of 1172 876 build.exe cmd.exe PID 876 wrote to memory of 1172 876 build.exe cmd.exe PID 1172 wrote to memory of 1640 1172 cmd.exe timeout.exe PID 1172 wrote to memory of 1640 1172 cmd.exe timeout.exe PID 1172 wrote to memory of 1640 1172 cmd.exe timeout.exe PID 1172 wrote to memory of 1640 1172 cmd.exe timeout.exe PID 1940 wrote to memory of 1652 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 1652 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 1652 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 1652 1940 cmd.exe schtasks.exe PID 1172 wrote to memory of 1632 1172 cmd.exe Windows Defender SmartScreen.exe PID 1172 wrote to memory of 1632 1172 cmd.exe Windows Defender SmartScreen.exe PID 1172 wrote to memory of 1632 1172 cmd.exe Windows Defender SmartScreen.exe PID 1172 wrote to memory of 1632 1172 cmd.exe Windows Defender SmartScreen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe"C:\Users\Admin\AppData\Local\Temp\6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\build.exe"C:\Users\Admin\AppData\Local\build.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender SmartScreen" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Defender SmartScreen" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.batFilesize
172B
MD5d2c5de9c0aaa4fd55b4ebc0626cfa6b5
SHA1bbc7c9ce3bd9e1b2299595d31ba570afb6717bbb
SHA25654ad0ad5590508bfe7c51723427422ec9196dc3a7542ecc02f16e1d45a30bcdf
SHA51218a0be4bb5f14b9700236de7c22661e03f7e7e8748af31c7ebb107f53f9e8e11224e3dc05beefec42c80bdf929338870b354adefd671baebf1b8327432d5926d
-
C:\Users\Admin\AppData\Local\build.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Local\build.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
memory/876-58-0x0000000000B90000-0x0000000000BA2000-memory.dmpFilesize
72KB
-
memory/876-59-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/876-55-0x0000000000000000-mapping.dmp
-
memory/956-54-0x0000000000110000-0x0000000000148000-memory.dmpFilesize
224KB
-
memory/1172-61-0x0000000000000000-mapping.dmp
-
memory/1632-67-0x0000000000000000-mapping.dmp
-
memory/1632-69-0x0000000001330000-0x0000000001342000-memory.dmpFilesize
72KB
-
memory/1640-63-0x0000000000000000-mapping.dmp
-
memory/1652-64-0x0000000000000000-mapping.dmp
-
memory/1940-60-0x0000000000000000-mapping.dmp