Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-02-2023 05:45
Behavioral task
behavioral1
Sample
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
Resource
win7-20220812-en
General
-
Target
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe
-
Size
45KB
-
MD5
b379d5f8e60203f7ac58330baf412e41
-
SHA1
de08737859edb749490b33a2426011e169321684
-
SHA256
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
-
SHA512
984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
SSDEEP
768:3ukzVT0kLd3WULgPdVmo2qD7KjGKG6PIyzjbFgX3i08Bobv+L4yboBDZzx:3ukzVT0Mq12KKYDy3bCXS1tSdzx
Malware Config
Extracted
asyncrat
0.5.7B
Default
101.33.208.151:6606
101.33.208.151:7707
101.33.208.151:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
window.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1948-54-0x00000000001F0000-0x0000000000202000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\window.exe asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat C:\Users\Admin\AppData\Roaming\window.exe asyncrat behavioral1/memory/960-65-0x0000000000390000-0x00000000003A2000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
window.exepid process 960 window.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1348 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1336 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exepid process 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exewindow.exedescription pid process Token: SeDebugPrivilege 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe Token: SeDebugPrivilege 960 window.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.execmd.execmd.exedescription pid process target process PID 1948 wrote to memory of 1552 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1552 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1552 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1552 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1348 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1348 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1348 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1948 wrote to memory of 1348 1948 fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe cmd.exe PID 1552 wrote to memory of 1748 1552 cmd.exe schtasks.exe PID 1552 wrote to memory of 1748 1552 cmd.exe schtasks.exe PID 1552 wrote to memory of 1748 1552 cmd.exe schtasks.exe PID 1552 wrote to memory of 1748 1552 cmd.exe schtasks.exe PID 1348 wrote to memory of 1336 1348 cmd.exe timeout.exe PID 1348 wrote to memory of 1336 1348 cmd.exe timeout.exe PID 1348 wrote to memory of 1336 1348 cmd.exe timeout.exe PID 1348 wrote to memory of 1336 1348 cmd.exe timeout.exe PID 1348 wrote to memory of 960 1348 cmd.exe window.exe PID 1348 wrote to memory of 960 1348 cmd.exe window.exe PID 1348 wrote to memory of 960 1348 cmd.exe window.exe PID 1348 wrote to memory of 960 1348 cmd.exe window.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"C:\Users\Admin\AppData\Local\Temp\fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "window" /tr '"C:\Users\Admin\AppData\Roaming\window.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp15C3.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\window.exe"C:\Users\Admin\AppData\Roaming\window.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp15C3.tmp.batFilesize
150B
MD5e8e2279cff4a54c3acc50b69035681fa
SHA10de39ae7c3647f6514af4cc19eb9c87c516762df
SHA256d47cb500f54173df16170f167d7c40f361d8b80239f00090ff31dcb72e0c54ee
SHA51208e995a125b601717431e97efb5f4b97d245eadd34052933fc0e5ad52e1ba3cc64bcd961b1f9fbc79c426905bb58fa204b990da4ef77a3ca35c7a9feacc326f1
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
C:\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
\Users\Admin\AppData\Roaming\window.exeFilesize
45KB
MD5b379d5f8e60203f7ac58330baf412e41
SHA1de08737859edb749490b33a2426011e169321684
SHA256fe497cd48b3e42022fa45d7048b88d832c0ae76fad7dd0616170ac143bb731f3
SHA512984c4ae0bc27ad4423e92c9e4d9f0194ff0d84e613e42592977396878b78776358b773ddc40bfc5a7e9351f4f778c9f663fbca08fd8bf3cbc7e142ec2d44b0ed
-
memory/960-63-0x0000000000000000-mapping.dmp
-
memory/960-65-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB
-
memory/1336-60-0x0000000000000000-mapping.dmp
-
memory/1348-57-0x0000000000000000-mapping.dmp
-
memory/1552-56-0x0000000000000000-mapping.dmp
-
memory/1748-58-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/1948-55-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB