Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-02-2023 03:48
Behavioral task
behavioral1
Sample
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
Resource
win7-20220812-en
General
-
Target
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
-
Size
45KB
-
MD5
b379d5f8e60203f7ac58330baf412e41
-
SHA1
de08737859edb749490b33a2426011e169321684
-
SHA256
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
-
SHA512
984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
SSDEEP
768:3ukzVT0kLd3WULgPdVmo2qD7KjGKG6PIyzjbFgX3i08Bobv+L4yboBDZzx:3ukzVT0Mq12KKYDy3bCXS1tSdzx
Malware Config
Extracted
asyncrat
0.5.7B
Default
101.33.208.151:6606
101.33.208.151:7707
101.33.208.151:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
window.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1668-54-0x0000000000880000-0x0000000000892000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\window.exe asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat behavioral1/memory/1824-65-0x0000000000E00000-0x0000000000E12000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
window.exepid process 1824 window.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2020 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 956 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exepid process 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exewindow.exedescription pid process Token: SeDebugPrivilege 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe Token: SeDebugPrivilege 1824 window.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.execmd.execmd.exedescription pid process target process PID 1668 wrote to memory of 1760 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 1760 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 1760 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 1760 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 2020 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 2020 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 2020 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1668 wrote to memory of 2020 1668 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 2020 wrote to memory of 956 2020 cmd.exe timeout.exe PID 2020 wrote to memory of 956 2020 cmd.exe timeout.exe PID 2020 wrote to memory of 956 2020 cmd.exe timeout.exe PID 2020 wrote to memory of 956 2020 cmd.exe timeout.exe PID 1760 wrote to memory of 1972 1760 cmd.exe schtasks.exe PID 1760 wrote to memory of 1972 1760 cmd.exe schtasks.exe PID 1760 wrote to memory of 1972 1760 cmd.exe schtasks.exe PID 1760 wrote to memory of 1972 1760 cmd.exe schtasks.exe PID 2020 wrote to memory of 1824 2020 cmd.exe window.exe PID 2020 wrote to memory of 1824 2020 cmd.exe window.exe PID 2020 wrote to memory of 1824 2020 cmd.exe window.exe PID 2020 wrote to memory of 1824 2020 cmd.exe window.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2656.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\window.exe"C:\Users\Admin\AppData\Roaming\window.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2656.tmp.batFilesize
150B
MD528e4605771ff3dd336e607756efa0cea
SHA17a1b9f295ffb58dc31f6b6d3c5be177c4889a30b
SHA25629b403635c1222055b6b2256a884bc1afb9910ea3785288b67e46ee0c0538986
SHA5125b162b0db128d05fc6778cd71d32efd36a32ea878317df43ebb520c1bec2f868e270355617faa12cbf2f5cac43104f83a8823a98306049bab2b31a35b7a626e0
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/1668-54-0x0000000000880000-0x0000000000892000-memory.dmpFilesize
72KB
-
memory/1668-55-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1760-56-0x0000000000000000-mapping.dmp
-
memory/1824-63-0x0000000000000000-mapping.dmp
-
memory/1824-65-0x0000000000E00000-0x0000000000E12000-memory.dmpFilesize
72KB
-
memory/1972-60-0x0000000000000000-mapping.dmp
-
memory/2020-57-0x0000000000000000-mapping.dmp