Analysis
-
max time kernel
43s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-02-2023 16:57
Behavioral task
behavioral1
Sample
0x00090000000122f1-69.exe
Resource
win7-20220812-en
General
-
Target
0x00090000000122f1-69.exe
-
Size
45KB
-
MD5
4b3284d70137fee18f1068d0b3ec3819
-
SHA1
24a47e72ea5f76bbc37b0281bb24508b631157de
-
SHA256
8ae63775359fa46ab17567259a6a504c60113868d706c1649b7e404aa0343010
-
SHA512
693cb57ee01b48daa08c3165187d29aad402e8fe8341e1050c0e6bfc7463b2723a6e5c6af762457cffee8ae2836fb3c7f3a73dfdd1ff50d51abc1e8f970d525d
-
SSDEEP
768:zuQSNTvEEaBrWUXQd5mo2qmibq/aSh6PIRzjbfgX3imDRq/JyfBDZvx:zuQSNT8542x4qjDR3boXSgRndvx
Malware Config
Extracted
asyncrat
0.5.7B
Default
135.148.113.4:6789
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Service Host.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/780-54-0x0000000001150000-0x0000000001162000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\Service Host.exe asyncrat C:\Users\Admin\AppData\Roaming\Service Host.exe asyncrat C:\Users\Admin\AppData\Roaming\Service Host.exe asyncrat behavioral1/memory/1352-65-0x0000000000880000-0x0000000000892000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Service Host.exepid process 1352 Service Host.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1736 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1396 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0x00090000000122f1-69.exepid process 780 0x00090000000122f1-69.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0x00090000000122f1-69.exeService Host.exedescription pid process Token: SeDebugPrivilege 780 0x00090000000122f1-69.exe Token: SeDebugPrivilege 1352 Service Host.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0x00090000000122f1-69.execmd.execmd.exedescription pid process target process PID 780 wrote to memory of 948 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 948 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 948 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 948 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 1736 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 1736 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 1736 780 0x00090000000122f1-69.exe cmd.exe PID 780 wrote to memory of 1736 780 0x00090000000122f1-69.exe cmd.exe PID 948 wrote to memory of 1552 948 cmd.exe schtasks.exe PID 948 wrote to memory of 1552 948 cmd.exe schtasks.exe PID 948 wrote to memory of 1552 948 cmd.exe schtasks.exe PID 948 wrote to memory of 1552 948 cmd.exe schtasks.exe PID 1736 wrote to memory of 1396 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 1396 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 1396 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 1396 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 1352 1736 cmd.exe Service Host.exe PID 1736 wrote to memory of 1352 1736 cmd.exe Service Host.exe PID 1736 wrote to memory of 1352 1736 cmd.exe Service Host.exe PID 1736 wrote to memory of 1352 1736 cmd.exe Service Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x00090000000122f1-69.exe"C:\Users\Admin\AppData\Local\Temp\0x00090000000122f1-69.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Service Host" /tr '"C:\Users\Admin\AppData\Roaming\Service Host.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Service Host" /tr '"C:\Users\Admin\AppData\Roaming\Service Host.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp974.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Service Host.exe"C:\Users\Admin\AppData\Roaming\Service Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp974.tmp.batFilesize
155B
MD504bcf54273ced7d069bb58433ec06ac8
SHA1e4f276bd46211ad73586b7250ba4dd8e8af72d1f
SHA256f45e7cda5312dc08259fb27bf72dd619de1c0c14c4bdfa8175430e63d7596459
SHA512533073fc5f17263144e6e882b70bd4f020baecde4c038d3f49cd7e2007178ec2c2b213140865ca694449ba53c290c319d80ea3fa7036548fd36e1988c836b8c8
-
C:\Users\Admin\AppData\Roaming\Service Host.exeFilesize
45KB
MD54b3284d70137fee18f1068d0b3ec3819
SHA124a47e72ea5f76bbc37b0281bb24508b631157de
SHA2568ae63775359fa46ab17567259a6a504c60113868d706c1649b7e404aa0343010
SHA512693cb57ee01b48daa08c3165187d29aad402e8fe8341e1050c0e6bfc7463b2723a6e5c6af762457cffee8ae2836fb3c7f3a73dfdd1ff50d51abc1e8f970d525d
-
C:\Users\Admin\AppData\Roaming\Service Host.exeFilesize
45KB
MD54b3284d70137fee18f1068d0b3ec3819
SHA124a47e72ea5f76bbc37b0281bb24508b631157de
SHA2568ae63775359fa46ab17567259a6a504c60113868d706c1649b7e404aa0343010
SHA512693cb57ee01b48daa08c3165187d29aad402e8fe8341e1050c0e6bfc7463b2723a6e5c6af762457cffee8ae2836fb3c7f3a73dfdd1ff50d51abc1e8f970d525d
-
\Users\Admin\AppData\Roaming\Service Host.exeFilesize
45KB
MD54b3284d70137fee18f1068d0b3ec3819
SHA124a47e72ea5f76bbc37b0281bb24508b631157de
SHA2568ae63775359fa46ab17567259a6a504c60113868d706c1649b7e404aa0343010
SHA512693cb57ee01b48daa08c3165187d29aad402e8fe8341e1050c0e6bfc7463b2723a6e5c6af762457cffee8ae2836fb3c7f3a73dfdd1ff50d51abc1e8f970d525d
-
memory/780-54-0x0000000001150000-0x0000000001162000-memory.dmpFilesize
72KB
-
memory/780-55-0x00000000758C1000-0x00000000758C3000-memory.dmpFilesize
8KB
-
memory/948-56-0x0000000000000000-mapping.dmp
-
memory/1352-63-0x0000000000000000-mapping.dmp
-
memory/1352-65-0x0000000000880000-0x0000000000892000-memory.dmpFilesize
72KB
-
memory/1396-60-0x0000000000000000-mapping.dmp
-
memory/1552-59-0x0000000000000000-mapping.dmp
-
memory/1736-57-0x0000000000000000-mapping.dmp