Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 12:16
Behavioral task
behavioral1
Sample
0A5556BE9428BB753FC53893A582FD42183762F198D83.exe
Resource
win7-20220901-en
General
-
Target
0A5556BE9428BB753FC53893A582FD42183762F198D83.exe
-
Size
47KB
-
MD5
725e1c369fb346eb8313e17fe8f7e328
-
SHA1
fbcdaa9b245834d26353b9ad10d26d180c696ac0
-
SHA256
0a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
-
SHA512
78676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
SSDEEP
768:4oFKMJMj5I4G3y/Nu8+7lnu1c3fT89VnbC53tjbfgr3iAvj29nnmfJ7ClZF2tYch:4oFKMJeYBn6c3fT6i3lborScYnmfErF
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla11.publicvm.com:6606
milla11.publicvm.com:7707
milla11.publicvm.com:8808
trffisyuiifgqcpeof
-
delay
6
-
install
true
-
install_file
explorere.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-132-0x0000000000DA0000-0x0000000000DB2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe -
Executes dropped EXE 1 IoCs
Processes:
explorere.exepid process 676 explorere.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4132 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exepid process 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exeexplorere.exedescription pid process Token: SeDebugPrivilege 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe Token: SeDebugPrivilege 676 explorere.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.execmd.execmd.exedescription pid process target process PID 4808 wrote to memory of 4456 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4808 wrote to memory of 4456 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4808 wrote to memory of 548 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4808 wrote to memory of 548 4808 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4456 wrote to memory of 4844 4456 cmd.exe schtasks.exe PID 4456 wrote to memory of 4844 4456 cmd.exe schtasks.exe PID 548 wrote to memory of 4132 548 cmd.exe timeout.exe PID 548 wrote to memory of 4132 548 cmd.exe timeout.exe PID 548 wrote to memory of 676 548 cmd.exe explorere.exe PID 548 wrote to memory of 676 548 cmd.exe explorere.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp83FA.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorere.exe"C:\Users\Admin\AppData\Roaming\explorere.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp83FA.tmp.batFilesize
153B
MD5232bfb0a288b107d19d41f1489c6af1b
SHA1df828d272d7d181354f57a4d0bb1015744dee8ef
SHA25614404daafb9c056c5f2aa6fbfa13dceee3ead457d3263e0ea96ed73fa431be70
SHA512af2791d0f2709233b462720c303105a71ae5b3d4969cc9fe287a267944da41f61cd890b94fec093470c0bd9e84e77405f356ef8aabdba10f44157960489a2e87
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
memory/548-135-0x0000000000000000-mapping.dmp
-
memory/676-140-0x0000000000000000-mapping.dmp
-
memory/676-143-0x00007FFA79FD0000-0x00007FFA7AA91000-memory.dmpFilesize
10.8MB
-
memory/676-144-0x00007FFA79FD0000-0x00007FFA7AA91000-memory.dmpFilesize
10.8MB
-
memory/4132-139-0x0000000000000000-mapping.dmp
-
memory/4456-134-0x0000000000000000-mapping.dmp
-
memory/4808-137-0x00007FFA79FD0000-0x00007FFA7AA91000-memory.dmpFilesize
10.8MB
-
memory/4808-133-0x00007FFA79FD0000-0x00007FFA7AA91000-memory.dmpFilesize
10.8MB
-
memory/4808-132-0x0000000000DA0000-0x0000000000DB2000-memory.dmpFilesize
72KB
-
memory/4844-136-0x0000000000000000-mapping.dmp