Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2023 01:24

General

  • Target

    1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

  • Size

    48KB

  • MD5

    6a2fe740af2f9b1bcf6b4f05bc38c810

  • SHA1

    17f247fb43800115495b4463f10355660e5d5b45

  • SHA256

    1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

  • SHA512

    12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

  • SSDEEP

    768:mUkPIL2C6y+DiNbik7U8Yb2g1WyCXvEgK/JSTJVc6KN:mU22UzbpAyCXnkJqJVclN

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

135.181.204.51:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    Desktop Window Manager.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
    "C:\Users\Admin\AppData\Local\Temp\1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:1332
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBA8B.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1412
      • C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
        "C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
    Filesize

    48KB

    MD5

    6a2fe740af2f9b1bcf6b4f05bc38c810

    SHA1

    17f247fb43800115495b4463f10355660e5d5b45

    SHA256

    1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

    SHA512

    12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

  • C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
    Filesize

    48KB

    MD5

    6a2fe740af2f9b1bcf6b4f05bc38c810

    SHA1

    17f247fb43800115495b4463f10355660e5d5b45

    SHA256

    1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

    SHA512

    12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

  • C:\Users\Admin\AppData\Local\Temp\tmpBA8B.tmp.bat
    Filesize

    169B

    MD5

    c9e292b9d40a21393fedb903f64e46bb

    SHA1

    568456d75bac545b62c75305f5697db397d2cc91

    SHA256

    2a932b7e1f23df8394853053533c9c881e480a4ca009376e15e0245429ba2d5e

    SHA512

    fe060fa0962db0a6106fbcd07d50ce87fd996c2b1bb70cb940c0296d21d1ab06ac014929bb3f4c6f1f719ff07257b3a9877e3b6bb754deb6f60f9a438af3836a

  • memory/628-135-0x0000000000000000-mapping.dmp
  • memory/1256-140-0x0000000000000000-mapping.dmp
  • memory/1256-143-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp
    Filesize

    10.8MB

  • memory/1256-144-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp
    Filesize

    10.8MB

  • memory/1332-138-0x0000000000000000-mapping.dmp
  • memory/1412-137-0x0000000000000000-mapping.dmp
  • memory/3996-132-0x0000000000980000-0x0000000000992000-memory.dmp
    Filesize

    72KB

  • memory/3996-139-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp
    Filesize

    10.8MB

  • memory/3996-133-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp
    Filesize

    10.8MB

  • memory/5000-134-0x0000000000000000-mapping.dmp