Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
13-02-2023 12:13
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
General
-
Target
tmp.exe
-
Size
5.3MB
-
MD5
6967092864e12d1bec4bdda56399ae44
-
SHA1
78458ea4a39f59869a131c1eff19f383bb8955f4
-
SHA256
aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
-
SHA512
34270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
SSDEEP
98304:pgG+mM6eVLwvCuTjZMyOgEdMD/cKr8njPFUxILCnrpP:h+AeVLwv5ayOZdA0K4nxUx+Y
Malware Config
Extracted
asyncrat
Default
months-documents.at.ply.gg:10134
months-documents.at.ply.gg:39185
杰Θio开ي9fd6比kVΒيmGΙ6Kz0h
-
delay
1
-
install
true
-
install_file
RuntimeBroker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-55-0x0000000000F20000-0x00000000027E0000-memory.dmp asyncrat behavioral1/memory/1752-57-0x0000000000F20000-0x00000000027E0000-memory.dmp asyncrat behavioral1/memory/1752-63-0x0000000000F20000-0x00000000027E0000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\RuntimeBroker.exe asyncrat C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe asyncrat C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe asyncrat behavioral1/memory/1316-70-0x0000000000F70000-0x0000000002830000-memory.dmp asyncrat behavioral1/memory/1316-71-0x0000000000F70000-0x0000000002830000-memory.dmp asyncrat behavioral1/memory/1316-72-0x0000000000F70000-0x0000000002830000-memory.dmp asyncrat behavioral1/memory/1316-73-0x0000000000F70000-0x0000000002830000-memory.dmp asyncrat behavioral1/memory/1316-74-0x00000000047E0000-0x0000000004814000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
RuntimeBroker.exepid process 1316 RuntimeBroker.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 976 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
tmp.exeRuntimeBroker.exepid process 1752 tmp.exe 1752 tmp.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe 1316 RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1324 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
tmp.exepid process 1752 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 1752 tmp.exe Token: SeDebugPrivilege 1316 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
tmp.exeRuntimeBroker.exepid process 1752 tmp.exe 1316 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.execmd.execmd.exedescription pid process target process PID 1752 wrote to memory of 1744 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 1744 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 1744 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 1744 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 976 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 976 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 976 1752 tmp.exe cmd.exe PID 1752 wrote to memory of 976 1752 tmp.exe cmd.exe PID 1744 wrote to memory of 1360 1744 cmd.exe schtasks.exe PID 1744 wrote to memory of 1360 1744 cmd.exe schtasks.exe PID 1744 wrote to memory of 1360 1744 cmd.exe schtasks.exe PID 1744 wrote to memory of 1360 1744 cmd.exe schtasks.exe PID 976 wrote to memory of 1324 976 cmd.exe timeout.exe PID 976 wrote to memory of 1324 976 cmd.exe timeout.exe PID 976 wrote to memory of 1324 976 cmd.exe timeout.exe PID 976 wrote to memory of 1324 976 cmd.exe timeout.exe PID 976 wrote to memory of 1316 976 cmd.exe RuntimeBroker.exe PID 976 wrote to memory of 1316 976 cmd.exe RuntimeBroker.exe PID 976 wrote to memory of 1316 976 cmd.exe RuntimeBroker.exe PID 976 wrote to memory of 1316 976 cmd.exe RuntimeBroker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3747.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3747.tmp.batFilesize
157B
MD56b7e21b1c9357187ad3be86c53cd4c28
SHA1c0aa4a5f39640b8cef66c36071419a9054f17a04
SHA25662a55c26cc7ad6c26634b73767955ec49449f61cc9a76f7d86f9eead2aa121b5
SHA5123c09cbe9ff4ff84a25666ddb58299d46f2b5cae3c7a0800118eda6c886903c78e51cf57d612148ec6e6f2c39f4c8aebac3d6a2b99577c2a46223dc89866481d6
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeFilesize
5.3MB
MD56967092864e12d1bec4bdda56399ae44
SHA178458ea4a39f59869a131c1eff19f383bb8955f4
SHA256aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
SHA51234270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeFilesize
5.3MB
MD56967092864e12d1bec4bdda56399ae44
SHA178458ea4a39f59869a131c1eff19f383bb8955f4
SHA256aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
SHA51234270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
\Users\Admin\AppData\Roaming\RuntimeBroker.exeFilesize
5.3MB
MD56967092864e12d1bec4bdda56399ae44
SHA178458ea4a39f59869a131c1eff19f383bb8955f4
SHA256aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
SHA51234270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
memory/976-59-0x0000000000000000-mapping.dmp
-
memory/1316-66-0x0000000000000000-mapping.dmp
-
memory/1316-74-0x00000000047E0000-0x0000000004814000-memory.dmpFilesize
208KB
-
memory/1316-73-0x0000000000F70000-0x0000000002830000-memory.dmpFilesize
24.8MB
-
memory/1316-72-0x0000000000F70000-0x0000000002830000-memory.dmpFilesize
24.8MB
-
memory/1316-71-0x0000000000F70000-0x0000000002830000-memory.dmpFilesize
24.8MB
-
memory/1316-70-0x0000000000F70000-0x0000000002830000-memory.dmpFilesize
24.8MB
-
memory/1316-69-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/1324-62-0x0000000000000000-mapping.dmp
-
memory/1360-60-0x0000000000000000-mapping.dmp
-
memory/1744-58-0x0000000000000000-mapping.dmp
-
memory/1752-55-0x0000000000F20000-0x00000000027E0000-memory.dmpFilesize
24.8MB
-
memory/1752-57-0x0000000000F20000-0x00000000027E0000-memory.dmpFilesize
24.8MB
-
memory/1752-56-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/1752-63-0x0000000000F20000-0x00000000027E0000-memory.dmpFilesize
24.8MB
-
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB