Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 05:16
Behavioral task
behavioral1
Sample
c875bcf1a868fbd4d782072878787785.exe
Resource
win7-20220812-en
General
-
Target
c875bcf1a868fbd4d782072878787785.exe
-
Size
45KB
-
MD5
c875bcf1a868fbd4d782072878787785
-
SHA1
71a396dcb26d19677f17c5b0f415918928081184
-
SHA256
8984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
-
SHA512
3732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
SSDEEP
768:JuK49TH4EjZWUR+ejmo2qrDKjGKG6PIyzjbFgX3i/Ei4s2/IBDZ7d:JuK49THf52OKYDy3bCXS/Eih2/ud7d
Malware Config
Extracted
asyncrat
0.5.7B
Default
eu-central-7075.packetriot.net:1604
eu-central-7075.packetriot.net:22993
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
scvhost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4724-132-0x0000000000170000-0x0000000000182000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\scvhost.exe asyncrat C:\Users\Admin\AppData\Roaming\scvhost.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c875bcf1a868fbd4d782072878787785.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation c875bcf1a868fbd4d782072878787785.exe -
Executes dropped EXE 1 IoCs
Processes:
scvhost.exepid process 2108 scvhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1704 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.exepid process 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe 4724 c875bcf1a868fbd4d782072878787785.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.exescvhost.exedescription pid process Token: SeDebugPrivilege 4724 c875bcf1a868fbd4d782072878787785.exe Token: SeDebugPrivilege 2108 scvhost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c875bcf1a868fbd4d782072878787785.execmd.execmd.exedescription pid process target process PID 4724 wrote to memory of 4028 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 4724 wrote to memory of 4028 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 4724 wrote to memory of 4028 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 4724 wrote to memory of 1640 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 4724 wrote to memory of 1640 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 4724 wrote to memory of 1640 4724 c875bcf1a868fbd4d782072878787785.exe cmd.exe PID 1640 wrote to memory of 1704 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 1704 1640 cmd.exe timeout.exe PID 1640 wrote to memory of 1704 1640 cmd.exe timeout.exe PID 4028 wrote to memory of 2024 4028 cmd.exe schtasks.exe PID 4028 wrote to memory of 2024 4028 cmd.exe schtasks.exe PID 4028 wrote to memory of 2024 4028 cmd.exe schtasks.exe PID 1640 wrote to memory of 2108 1640 cmd.exe scvhost.exe PID 1640 wrote to memory of 2108 1640 cmd.exe scvhost.exe PID 1640 wrote to memory of 2108 1640 cmd.exe scvhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c875bcf1a868fbd4d782072878787785.exe"C:\Users\Admin\AppData\Local\Temp\c875bcf1a868fbd4d782072878787785.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "scvhost" /tr '"C:\Users\Admin\AppData\Roaming\scvhost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "scvhost" /tr '"C:\Users\Admin\AppData\Roaming\scvhost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp71D9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\scvhost.exe"C:\Users\Admin\AppData\Roaming\scvhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp71D9.tmp.batFilesize
151B
MD54d3c7b519d70150a0dd7324e8bb56307
SHA1ce68f30882e8595c674be8d8fa4b17df8a3d5496
SHA25636a61881f867f0dd672b5f9396bcea6ef1cdb1a78a150c5423264311daed6273
SHA512296e564f47ba96fb8ed702efc7d8d65657d82424158334366d166b34b01aac9d0af14f713a7d8f2a5c9282e9360b7684415242859d5ac46a9d6c517ef324c1ee
-
C:\Users\Admin\AppData\Roaming\scvhost.exeFilesize
45KB
MD5c875bcf1a868fbd4d782072878787785
SHA171a396dcb26d19677f17c5b0f415918928081184
SHA2568984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
SHA5123732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
C:\Users\Admin\AppData\Roaming\scvhost.exeFilesize
45KB
MD5c875bcf1a868fbd4d782072878787785
SHA171a396dcb26d19677f17c5b0f415918928081184
SHA2568984004d5e340774e8e22b3945214f3d3d4645d71f88a10ffac19ba1f6c7bc28
SHA5123732bbaa93a773054d2f63e947a450fe70018cf57bddc68725408959f8bf7ce0f0769671a2fb2884324a5419b9e1da3a88bf25dd5dc23c1db41de7a5340cae82
-
memory/1640-135-0x0000000000000000-mapping.dmp
-
memory/1704-137-0x0000000000000000-mapping.dmp
-
memory/2024-138-0x0000000000000000-mapping.dmp
-
memory/2108-139-0x0000000000000000-mapping.dmp
-
memory/4028-134-0x0000000000000000-mapping.dmp
-
memory/4724-132-0x0000000000170000-0x0000000000182000-memory.dmpFilesize
72KB
-
memory/4724-133-0x0000000004E00000-0x0000000004E9C000-memory.dmpFilesize
624KB