Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 05:16
Behavioral task
behavioral1
Sample
c875bcf1a868fbd4d782072878787785.exe
Resource
win7-20220812-en
General
-
Target
c875bcf1a868fbd4d782072878787785.exe
-
Size
45KB
-
MD5
c875bcf1a868fbd4d782072878787785
-
SHA1
71a396dcb26d19677f17c5b0f415918928081184
-
SHA256
8984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
-
SHA512
3732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
SSDEEP
768:JuK49TH4EjZWUR+ejmo2qrDKjGKG6PIyzjbFgX3i/Ei4s2/IBDZ7d:JuK49THf52OKYDy3bCXS/Eih2/ud7d
Malware Config
Extracted
asyncrat
0.5.7B
Default
eu-central-7075.packetriot.net:1604
eu-central-7075.packetriot.net:22993
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
scvhost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/864-54-0x0000000001360000-0x0000000001372000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\scvhost.exe asyncrat \Users\Admin\AppData\Roaming\scvhost.exe asyncrat C:\Users\Admin\AppData\Roaming\scvhost.exe asyncrat behavioral1/memory/1612-65-0x0000000000340000-0x0000000000352000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
scvhost.exepid process 1612 scvhost.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2024 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1716 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.exepid process 864 c875bcf1a868fbd4d782072878787785.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.exescvhost.exedescription pid process Token: SeDebugPrivilege 864 c875bcf1a868fbd4d782072878787785.exe Token: SeDebugPrivilege 1612 scvhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.execmd.execmd.exedescription pid process target process PID 864 wrote to memory of 2028 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2028 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2028 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2028 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2024 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2024 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2024 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 864 wrote to memory of 2024 864 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 2028 wrote to memory of 1104 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1104 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1104 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1104 2028 cmd.exe schtasks.exe PID 2024 wrote to memory of 1716 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1716 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1716 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1716 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1612 2024 cmd.exe scvhost.exe PID 2024 wrote to memory of 1612 2024 cmd.exe scvhost.exe PID 2024 wrote to memory of 1612 2024 cmd.exe scvhost.exe PID 2024 wrote to memory of 1612 2024 cmd.exe scvhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c875bcf1a868fbd4d782072878787785.exe"C:\Users\Admin\AppData\Local\Temp\c875bcf1a868fbd4d782072878787785.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "scvhost" /tr '"C:\Users\Admin\AppData\Roaming\scvhost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "scvhost" /tr '"C:\Users\Admin\AppData\Roaming\scvhost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp15A4.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\scvhost.exe"C:\Users\Admin\AppData\Roaming\scvhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp15A4.tmp.batFilesize
151B
MD5c9ac2dd685e8ab9182ea1a6085c2b8de
SHA1b53ff86c1a786a08a5ee1dea5ed61eaeb5650f18
SHA2560849d929a2172088af375ac758ef119a1ac5a5524f7297a9c41959e764884ca3
SHA512fc019183a5e3dd1695c50d522afb1caee1c57514f4bb64e8d8a97e47a9646641bf9e1fb88b46dcbfd4922a464e7dfc8a4db4b458753d276351b8295ce338701a
-
C:\Users\Admin\AppData\Roaming\scvhost.exeFilesize
45KB
MD5c875bcf1a868fbd4d782072878787785
SHA171a396dcb26d19677f17c5b0f415918928081184
SHA2568984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
SHA5123732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
C:\Users\Admin\AppData\Roaming\scvhost.exeFilesize
45KB
MD5c875bcf1a868fbd4d782072878787785
SHA171a396dcb26d19677f17c5b0f415918928081184
SHA2568984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
SHA5123732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
\Users\Admin\AppData\Roaming\scvhost.exeFilesize
45KB
MD5c875bcf1a868fbd4d782072878787785
SHA171a396dcb26d19677f17c5b0f415918928081184
SHA2568984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
SHA5123732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
memory/864-54-0x0000000001360000-0x0000000001372000-memory.dmpFilesize
72KB
-
memory/864-55-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB
-
memory/1104-59-0x0000000000000000-mapping.dmp
-
memory/1612-63-0x0000000000000000-mapping.dmp
-
memory/1612-65-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/1716-60-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp
-
memory/2028-56-0x0000000000000000-mapping.dmp