Analysis
-
max time kernel
45s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-02-2023 12:16
Behavioral task
behavioral1
Sample
0A5556BE9428BB753FC53893A582FD42183762F198D83.exe
Resource
win7-20220901-en
General
-
Target
0A5556BE9428BB753FC53893A582FD42183762F198D83.exe
-
Size
47KB
-
MD5
725e1c369fb346eb8313e17fe8f7e328
-
SHA1
fbcdaa9b245834d26353b9ad10d26d180c696ac0
-
SHA256
0a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
-
SHA512
78676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
SSDEEP
768:4oFKMJMj5I4G3y/Nu8+7lnu1c3fT89VnbC53tjbfgr3iAvj29nnmfJ7ClZF2tYch:4oFKMJeYBn6c3fT6i3lborScYnmfErF
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla11.publicvm.com:6606
milla11.publicvm.com:7707
milla11.publicvm.com:8808
trffisyuiifgqcpeof
-
delay
6
-
install
true
-
install_file
explorere.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-54-0x0000000001290000-0x00000000012A2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat behavioral1/memory/956-63-0x0000000000EF0000-0x0000000000F02000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
explorere.exepid process 956 explorere.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1072 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exepid process 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exeexplorere.exedescription pid process Token: SeDebugPrivilege 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe Token: SeDebugPrivilege 956 explorere.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.execmd.execmd.exedescription pid process target process PID 1388 wrote to memory of 1488 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1388 wrote to memory of 1488 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1388 wrote to memory of 1488 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1388 wrote to memory of 552 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1388 wrote to memory of 552 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1388 wrote to memory of 552 1388 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 1488 wrote to memory of 1744 1488 cmd.exe schtasks.exe PID 1488 wrote to memory of 1744 1488 cmd.exe schtasks.exe PID 1488 wrote to memory of 1744 1488 cmd.exe schtasks.exe PID 552 wrote to memory of 1072 552 cmd.exe timeout.exe PID 552 wrote to memory of 1072 552 cmd.exe timeout.exe PID 552 wrote to memory of 1072 552 cmd.exe timeout.exe PID 552 wrote to memory of 956 552 cmd.exe explorere.exe PID 552 wrote to memory of 956 552 cmd.exe explorere.exe PID 552 wrote to memory of 956 552 cmd.exe explorere.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3229.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorere.exe"C:\Users\Admin\AppData\Roaming\explorere.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3229.tmp.batFilesize
153B
MD5174e1831eb445a292bbc7543d16c9fac
SHA168ccf7f30f5552023eec9ce2dbad2a1ff3fbb8a4
SHA256f882109814009a8221d0e9cda1c7ba72df1886eea0f6bfd0f8689cae675987b5
SHA512ca79576b3ea2bd16b2b7d480503d0ed9de3ad7dce2f612817388fae65349235165cbb8475133932a18ac689b8ab9b3548e29f54cd953987867c5953d48d04b16
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
memory/552-56-0x0000000000000000-mapping.dmp
-
memory/956-60-0x0000000000000000-mapping.dmp
-
memory/956-63-0x0000000000EF0000-0x0000000000F02000-memory.dmpFilesize
72KB
-
memory/1072-59-0x0000000000000000-mapping.dmp
-
memory/1388-54-0x0000000001290000-0x00000000012A2000-memory.dmpFilesize
72KB
-
memory/1488-55-0x0000000000000000-mapping.dmp
-
memory/1744-57-0x0000000000000000-mapping.dmp