Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 17:06
Behavioral task
behavioral1
Sample
e16de135773985fd9ef2e0afb94f774a.exe
Resource
win7-20220812-en
General
-
Target
e16de135773985fd9ef2e0afb94f774a.exe
-
Size
45KB
-
MD5
e16de135773985fd9ef2e0afb94f774a
-
SHA1
84c2dd69ec6247cea480925d9ecfc728f5d04c58
-
SHA256
af32b03c1fdbc8a4dd60fdea328134b6a34946c7c77cd743600a2101a70c6630
-
SHA512
0573dbceabcef8f74d6a32d45645ad297b6f28e7f26043ce0c1a68bd24cb8a67b75158050e2ee4b1dcdd37b660da26ecc135dd3deb630dee9c10a3863e817c34
-
SSDEEP
768:DuwQNToEjaNLWU3zKZmo2q723YZJugbbb409ybdPIK/JjbOgX3iWS9UmozmBDZfx:DuwQNToqaS2DYosymK/pbxXSzdfx
Malware Config
Extracted
asyncrat
0.5.7B
Default
sr5gsedfgwsers.freemyip.com:15420
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
tmpC723.tmp.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-132-0x00000000007E0000-0x00000000007F2000-memory.dmp asyncrat C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe asyncrat C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e16de135773985fd9ef2e0afb94f774a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation e16de135773985fd9ef2e0afb94f774a.exe -
Executes dropped EXE 1 IoCs
Processes:
tmpC723.tmp.exepid process 4584 tmpC723.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4688 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
e16de135773985fd9ef2e0afb94f774a.exepid process 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe 4224 e16de135773985fd9ef2e0afb94f774a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e16de135773985fd9ef2e0afb94f774a.exetmpC723.tmp.exedescription pid process Token: SeDebugPrivilege 4224 e16de135773985fd9ef2e0afb94f774a.exe Token: SeDebugPrivilege 4584 tmpC723.tmp.exe Token: SeDebugPrivilege 4584 tmpC723.tmp.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e16de135773985fd9ef2e0afb94f774a.execmd.execmd.exedescription pid process target process PID 4224 wrote to memory of 4444 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4224 wrote to memory of 4444 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4224 wrote to memory of 4444 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4224 wrote to memory of 4792 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4224 wrote to memory of 4792 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4224 wrote to memory of 4792 4224 e16de135773985fd9ef2e0afb94f774a.exe cmd.exe PID 4444 wrote to memory of 4720 4444 cmd.exe schtasks.exe PID 4444 wrote to memory of 4720 4444 cmd.exe schtasks.exe PID 4444 wrote to memory of 4720 4444 cmd.exe schtasks.exe PID 4792 wrote to memory of 4688 4792 cmd.exe timeout.exe PID 4792 wrote to memory of 4688 4792 cmd.exe timeout.exe PID 4792 wrote to memory of 4688 4792 cmd.exe timeout.exe PID 4792 wrote to memory of 4584 4792 cmd.exe tmpC723.tmp.exe PID 4792 wrote to memory of 4584 4792 cmd.exe tmpC723.tmp.exe PID 4792 wrote to memory of 4584 4792 cmd.exe tmpC723.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e16de135773985fd9ef2e0afb94f774a.exe"C:\Users\Admin\AppData\Local\Temp\e16de135773985fd9ef2e0afb94f774a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "tmpC723.tmp" /tr '"C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "tmpC723.tmp" /tr '"C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9252.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9252.tmp.batFilesize
158B
MD54d68e413fc3a46c66f5885c5748dc684
SHA1efee4214c82096395857e2e6d8bc760590e81d0b
SHA256570d14befc0055ac29f8aea374612462d202e927069e1f95557639d32eb37198
SHA512e7a7804eb9c0abcfb2edb20e021f0ae90e7538a483a7f44f0dba428edecd2d1ae7f56a4db2ad30528c13c99988e4214a413885700590bc807273f411d6a34d5f
-
C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exeFilesize
45KB
MD5e16de135773985fd9ef2e0afb94f774a
SHA184c2dd69ec6247cea480925d9ecfc728f5d04c58
SHA256af32b03c1fdbc8a4dd60fdea328134b6a34946c7c77cd743600a2101a70c6630
SHA5120573dbceabcef8f74d6a32d45645ad297b6f28e7f26043ce0c1a68bd24cb8a67b75158050e2ee4b1dcdd37b660da26ecc135dd3deb630dee9c10a3863e817c34
-
C:\Users\Admin\AppData\Local\Temp\tmpC723.tmp.exeFilesize
45KB
MD5e16de135773985fd9ef2e0afb94f774a
SHA184c2dd69ec6247cea480925d9ecfc728f5d04c58
SHA256af32b03c1fdbc8a4dd60fdea328134b6a34946c7c77cd743600a2101a70c6630
SHA5120573dbceabcef8f74d6a32d45645ad297b6f28e7f26043ce0c1a68bd24cb8a67b75158050e2ee4b1dcdd37b660da26ecc135dd3deb630dee9c10a3863e817c34
-
memory/4224-132-0x00000000007E0000-0x00000000007F2000-memory.dmpFilesize
72KB
-
memory/4224-133-0x0000000005280000-0x00000000052E6000-memory.dmpFilesize
408KB
-
memory/4224-134-0x00000000056D0000-0x000000000576C000-memory.dmpFilesize
624KB
-
memory/4444-135-0x0000000000000000-mapping.dmp
-
memory/4584-140-0x0000000000000000-mapping.dmp
-
memory/4584-143-0x0000000006410000-0x00000000069B4000-memory.dmpFilesize
5.6MB
-
memory/4688-139-0x0000000000000000-mapping.dmp
-
memory/4720-137-0x0000000000000000-mapping.dmp
-
memory/4792-136-0x0000000000000000-mapping.dmp