Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2023 12:13
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
General
-
Target
tmp.exe
-
Size
5.3MB
-
MD5
6967092864e12d1bec4bdda56399ae44
-
SHA1
78458ea4a39f59869a131c1eff19f383bb8955f4
-
SHA256
aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
-
SHA512
34270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
SSDEEP
98304:pgG+mM6eVLwvCuTjZMyOgEdMD/cKr8njPFUxILCnrpP:h+AeVLwv5ayOZdA0K4nxUx+Y
Malware Config
Extracted
asyncrat
Default
months-documents.at.ply.gg:10134
months-documents.at.ply.gg:39185
杰Θio开ي9fd6比kVΒيmGΙ6Kz0h
-
delay
1
-
install
true
-
install_file
RuntimeBroker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/676-132-0x0000000000430000-0x0000000001CF0000-memory.dmp asyncrat behavioral2/memory/676-134-0x0000000000430000-0x0000000001CF0000-memory.dmp asyncrat behavioral2/memory/676-140-0x0000000000430000-0x0000000001CF0000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe asyncrat C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe asyncrat behavioral2/memory/4904-144-0x0000000000750000-0x0000000002010000-memory.dmp asyncrat behavioral2/memory/4904-145-0x0000000000750000-0x0000000002010000-memory.dmp asyncrat behavioral2/memory/4904-147-0x0000000000750000-0x0000000002010000-memory.dmp asyncrat behavioral2/memory/4904-151-0x0000000000750000-0x0000000002010000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp.exe -
Executes dropped EXE 1 IoCs
Processes:
RuntimeBroker.exepid process 4904 RuntimeBroker.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
tmp.exeRuntimeBroker.exepid process 676 tmp.exe 676 tmp.exe 676 tmp.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe 4904 RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2024 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
tmp.exepid process 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe 676 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 676 tmp.exe Token: SeDebugPrivilege 4904 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
tmp.exeRuntimeBroker.exepid process 676 tmp.exe 4904 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.execmd.execmd.exedescription pid process target process PID 676 wrote to memory of 4092 676 tmp.exe cmd.exe PID 676 wrote to memory of 4092 676 tmp.exe cmd.exe PID 676 wrote to memory of 4092 676 tmp.exe cmd.exe PID 676 wrote to memory of 4712 676 tmp.exe cmd.exe PID 676 wrote to memory of 4712 676 tmp.exe cmd.exe PID 676 wrote to memory of 4712 676 tmp.exe cmd.exe PID 4092 wrote to memory of 2112 4092 cmd.exe schtasks.exe PID 4092 wrote to memory of 2112 4092 cmd.exe schtasks.exe PID 4092 wrote to memory of 2112 4092 cmd.exe schtasks.exe PID 4712 wrote to memory of 2024 4712 cmd.exe timeout.exe PID 4712 wrote to memory of 2024 4712 cmd.exe timeout.exe PID 4712 wrote to memory of 2024 4712 cmd.exe timeout.exe PID 4712 wrote to memory of 4904 4712 cmd.exe RuntimeBroker.exe PID 4712 wrote to memory of 4904 4712 cmd.exe RuntimeBroker.exe PID 4712 wrote to memory of 4904 4712 cmd.exe RuntimeBroker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB1B1.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB1B1.tmp.batFilesize
157B
MD581e63d444c1ba8402436f30c6c43b478
SHA148d1819bd84a78c27bc4e10eb2681a996e5b664c
SHA2565111f558533adb9629d0bcb95248f4a34c5f37b8aba775a0ac07f765c6ba2204
SHA512e6a52503fbd9b69647a363270ea070086e10fb15d0363d582506f6c545b73f6996064f5307b2d6d8efcfd05b581a80399ffdcbbc1059e93b0d8f0c110a5ac46f
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeFilesize
5.3MB
MD56967092864e12d1bec4bdda56399ae44
SHA178458ea4a39f59869a131c1eff19f383bb8955f4
SHA256aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
SHA51234270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeFilesize
5.3MB
MD56967092864e12d1bec4bdda56399ae44
SHA178458ea4a39f59869a131c1eff19f383bb8955f4
SHA256aafd84bfc4bfd841eee42e253df9df9868a4fc7a90474a9200940d9b6cbc35fa
SHA51234270c2c716e8ee6907ec48d92aea0fa5a88cd79343b3b3fe7eb4b00068445bb7f9d640f4aed166ade9bb63cc562467c53af5f188081953a5772463a7ce258fb
-
memory/676-140-0x0000000000430000-0x0000000001CF0000-memory.dmpFilesize
24.8MB
-
memory/676-133-0x000000007F8D0000-0x000000007FCA1000-memory.dmpFilesize
3.8MB
-
memory/676-134-0x0000000000430000-0x0000000001CF0000-memory.dmpFilesize
24.8MB
-
memory/676-132-0x0000000000430000-0x0000000001CF0000-memory.dmpFilesize
24.8MB
-
memory/2024-139-0x0000000000000000-mapping.dmp
-
memory/2112-137-0x0000000000000000-mapping.dmp
-
memory/4092-135-0x0000000000000000-mapping.dmp
-
memory/4712-136-0x0000000000000000-mapping.dmp
-
memory/4904-147-0x0000000000750000-0x0000000002010000-memory.dmpFilesize
24.8MB
-
memory/4904-144-0x0000000000750000-0x0000000002010000-memory.dmpFilesize
24.8MB
-
memory/4904-145-0x0000000000750000-0x0000000002010000-memory.dmpFilesize
24.8MB
-
memory/4904-146-0x000000007F630000-0x000000007FA01000-memory.dmpFilesize
3.8MB
-
memory/4904-141-0x0000000000000000-mapping.dmp
-
memory/4904-148-0x000000000ADE0000-0x000000000AE7C000-memory.dmpFilesize
624KB
-
memory/4904-149-0x000000000B430000-0x000000000B9D4000-memory.dmpFilesize
5.6MB
-
memory/4904-150-0x000000000AE80000-0x000000000AEE6000-memory.dmpFilesize
408KB
-
memory/4904-151-0x0000000000750000-0x0000000002010000-memory.dmpFilesize
24.8MB
-
memory/4904-152-0x000000000C620000-0x000000000C696000-memory.dmpFilesize
472KB
-
memory/4904-153-0x000000000C600000-0x000000000C61E000-memory.dmpFilesize
120KB
-
memory/4904-154-0x000000000C830000-0x000000000C8C2000-memory.dmpFilesize
584KB