Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2023 03:48
Behavioral task
behavioral1
Sample
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
Resource
win7-20220812-en
General
-
Target
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
-
Size
45KB
-
MD5
b379d5f8e60203f7ac58330baf412e41
-
SHA1
de08737859edb749490b33a2426011e169321684
-
SHA256
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
-
SHA512
984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
SSDEEP
768:3ukzVT0kLd3WULgPdVmo2qD7KjGKG6PIyzjbFgX3i08Bobv+L4yboBDZzx:3ukzVT0Mq12KKYDy3bCXS1tSdzx
Malware Config
Extracted
asyncrat
0.5.7B
Default
101.33.208.151:6606
101.33.208.151:7707
101.33.208.151:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
window.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5088-132-0x0000000000660000-0x0000000000672000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe -
Executes dropped EXE 1 IoCs
Processes:
window.exepid process 1816 window.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4452 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exepid process 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exewindow.exedescription pid process Token: SeDebugPrivilege 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe Token: SeDebugPrivilege 1816 window.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.execmd.execmd.exedescription pid process target process PID 5088 wrote to memory of 3432 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 5088 wrote to memory of 3432 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 5088 wrote to memory of 3432 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 5088 wrote to memory of 4128 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 5088 wrote to memory of 4128 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 5088 wrote to memory of 4128 5088 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 3432 wrote to memory of 2616 3432 cmd.exe schtasks.exe PID 3432 wrote to memory of 2616 3432 cmd.exe schtasks.exe PID 3432 wrote to memory of 2616 3432 cmd.exe schtasks.exe PID 4128 wrote to memory of 4452 4128 cmd.exe timeout.exe PID 4128 wrote to memory of 4452 4128 cmd.exe timeout.exe PID 4128 wrote to memory of 4452 4128 cmd.exe timeout.exe PID 4128 wrote to memory of 1816 4128 cmd.exe window.exe PID 4128 wrote to memory of 1816 4128 cmd.exe window.exe PID 4128 wrote to memory of 1816 4128 cmd.exe window.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp70FE.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\window.exe"C:\Users\Admin\AppData\Roaming\window.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp70FE.tmp.batFilesize
150B
MD5a612fd86a80b9a72eb1c04fc93604cbb
SHA19479a473a51b97d9e3014ce9ab7ece69320bc67d
SHA256db4a472d9dac37e815ce110c59eb5f21ea5123364ef6aad5fc90246cb551cbdc
SHA5125740e7c3cef7ec6c48d22d68601915698c7d04461e54c8ba8f3c901edb0557a35aebf0bfca367ea3508546f0ec9bd91fed3efb0172c28ca92c4bbafb25a4c7bc
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
memory/1816-139-0x0000000000000000-mapping.dmp
-
memory/2616-137-0x0000000000000000-mapping.dmp
-
memory/3432-134-0x0000000000000000-mapping.dmp
-
memory/4128-135-0x0000000000000000-mapping.dmp
-
memory/4452-138-0x0000000000000000-mapping.dmp
-
memory/5088-132-0x0000000000660000-0x0000000000672000-memory.dmpFilesize
72KB
-
memory/5088-133-0x0000000005300000-0x000000000539C000-memory.dmpFilesize
624KB