Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe
Resource
win7-20221111-en
General
-
Target
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe
-
Size
195KB
-
MD5
66a167b944c4ea45a207f551e2c9fc28
-
SHA1
88703c2bf165899ec004dab9f5f273c46a8d286c
-
SHA256
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38
-
SHA512
89d647f0593518fa63976e168588c41bacd91bd6be59550e535a27ca7d817f29705830ce5ad3810a76096934d66216afb3f4f670309c102f1f4c496027969370
-
SSDEEP
1536:hu0Fi41HYlZuIyPGSRfxp6kghBtdhv/oOK5XjJwkA1MmnQTNSbgjxAAnieghr4Dq:huTnaYfshPPD74Jo50093FFd7GEawuJ
Malware Config
Extracted
asyncrat
0.5.7B
Default
ValentinMihai-48225.portmap.io:48225=>7119:48225
ValentinMihai-48225.portmap.io:48225=>7119:7119
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Windows Defender SmartScreen.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\build.exe asyncrat C:\Users\Admin\AppData\Roaming\build.exe asyncrat behavioral2/memory/3208-138-0x0000000000720000-0x0000000000732000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe asyncrat C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe asyncrat -
Executes dropped EXE 2 IoCs
Processes:
build.exeWindows Defender SmartScreen.exepid process 3208 build.exe 5028 Windows Defender SmartScreen.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exebuild.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation build.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4880 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
build.exepid process 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe 3208 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exeWindows Defender SmartScreen.exedescription pid process Token: SeDebugPrivilege 3208 build.exe Token: SeDebugPrivilege 5028 Windows Defender SmartScreen.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exebuild.execmd.execmd.exedescription pid process target process PID 384 wrote to memory of 3208 384 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 384 wrote to memory of 3208 384 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 384 wrote to memory of 3208 384 6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe build.exe PID 3208 wrote to memory of 3856 3208 build.exe cmd.exe PID 3208 wrote to memory of 3856 3208 build.exe cmd.exe PID 3208 wrote to memory of 3856 3208 build.exe cmd.exe PID 3856 wrote to memory of 4376 3856 cmd.exe schtasks.exe PID 3856 wrote to memory of 4376 3856 cmd.exe schtasks.exe PID 3856 wrote to memory of 4376 3856 cmd.exe schtasks.exe PID 3208 wrote to memory of 4924 3208 build.exe cmd.exe PID 3208 wrote to memory of 4924 3208 build.exe cmd.exe PID 3208 wrote to memory of 4924 3208 build.exe cmd.exe PID 4924 wrote to memory of 4880 4924 cmd.exe timeout.exe PID 4924 wrote to memory of 4880 4924 cmd.exe timeout.exe PID 4924 wrote to memory of 4880 4924 cmd.exe timeout.exe PID 4924 wrote to memory of 5028 4924 cmd.exe Windows Defender SmartScreen.exe PID 4924 wrote to memory of 5028 4924 cmd.exe Windows Defender SmartScreen.exe PID 4924 wrote to memory of 5028 4924 cmd.exe Windows Defender SmartScreen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe"C:\Users\Admin\AppData\Local\Temp\6815ff5dc021df4556f774108073648ca9191f7634c9fca94707d54ef686ee38.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\build.exe"C:\Users\Admin\AppData\Roaming\build.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender SmartScreen" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Defender SmartScreen" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA609.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA609.tmp.batFilesize
172B
MD5bd818ab02b7073fc8b18949a3ee8ee52
SHA1fca449b9027391e2f2dc9a90e028768fae297415
SHA25633e4ab0c5483529e5eeafee69512c78d867b284c2844fb245e89a9f5deb076d0
SHA5123aaedfba87d62c89d4018df771036ecb697c765e97db2d65cb9b8e2986e916c68f472f3a9a6bc723837a97a0e0307f657c079903cf5420c22ad7eb9e2637f5c1
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Roaming\Windows Defender SmartScreen.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Roaming\build.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
C:\Users\Admin\AppData\Roaming\build.exeFilesize
47KB
MD520f0a4c172d05e4c9409dfe2dd8f773f
SHA139af4d0c658263df11c6b9951fa5336b1bedd817
SHA2562dcecfb77772e8dc0b56d6421aa0f782fabe4d1730f29880bfd3edfee98bdc5f
SHA512406dcc9775a66db15e99ea9db277ccdbc15b6f86e09ce0e0ac45cdbb2218ee2440117430574c1aed5c42b28d47a8a997d27221b5e0c1021b722f826858fb43f8
-
memory/384-133-0x00007FFC18140000-0x00007FFC18C01000-memory.dmpFilesize
10.8MB
-
memory/384-136-0x00007FFC18140000-0x00007FFC18C01000-memory.dmpFilesize
10.8MB
-
memory/384-132-0x0000000000A50000-0x0000000000A88000-memory.dmpFilesize
224KB
-
memory/3208-134-0x0000000000000000-mapping.dmp
-
memory/3208-138-0x0000000000720000-0x0000000000732000-memory.dmpFilesize
72KB
-
memory/3208-139-0x00000000053E0000-0x000000000547C000-memory.dmpFilesize
624KB
-
memory/3856-140-0x0000000000000000-mapping.dmp
-
memory/4376-141-0x0000000000000000-mapping.dmp
-
memory/4880-144-0x0000000000000000-mapping.dmp
-
memory/4924-142-0x0000000000000000-mapping.dmp
-
memory/5028-145-0x0000000000000000-mapping.dmp