Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-02-2023 15:38
Static task
static1
Behavioral task
behavioral1
Sample
oDEEOpxV4qBlrgj.exe
Resource
win7-20221111-en
General
-
Target
oDEEOpxV4qBlrgj.exe
-
Size
621KB
-
MD5
45f42e17dd7229140a940f3346ddf3a9
-
SHA1
dbf51050b80bd2932bfed81fc867495bbd856ca6
-
SHA256
785ebeb84c2bc65d0b0a55691f18631c110531b132f60535b8462684d2492b81
-
SHA512
3a1c2a3ee5382c61759e1a2664f2871eb49c567de6dec8ad70e797d4698f7950ec78eb567aba3ad286723bae926856509e880777d4165a75cc2463fcb4fbc7ef
-
SSDEEP
12288:NeHlPTZh6q6/TKPzG7rjkKzG9DP+ogIGdjPETxpj:NeHllY/TKPzG7+B+TIOjPWxF
Malware Config
Extracted
asyncrat
0.5.7B
Default
192.3.193.136:2023
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/388-150-0x0000000000400000-0x000000000041E000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oDEEOpxV4qBlrgj.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation oDEEOpxV4qBlrgj.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oDEEOpxV4qBlrgj.exedescription pid process target process PID 4664 set thread context of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
oDEEOpxV4qBlrgj.exepowershell.exepowershell.exepid process 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4980 powershell.exe 3360 powershell.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4664 oDEEOpxV4qBlrgj.exe 4980 powershell.exe 4664 oDEEOpxV4qBlrgj.exe 3360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
oDEEOpxV4qBlrgj.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4664 oDEEOpxV4qBlrgj.exe Token: SeDebugPrivilege 3360 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 388 RegSvcs.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
oDEEOpxV4qBlrgj.exedescription pid process target process PID 4664 wrote to memory of 4980 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 4980 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 4980 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 3360 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 3360 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 3360 4664 oDEEOpxV4qBlrgj.exe powershell.exe PID 4664 wrote to memory of 4912 4664 oDEEOpxV4qBlrgj.exe schtasks.exe PID 4664 wrote to memory of 4912 4664 oDEEOpxV4qBlrgj.exe schtasks.exe PID 4664 wrote to memory of 4912 4664 oDEEOpxV4qBlrgj.exe schtasks.exe PID 4664 wrote to memory of 2760 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 2760 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 2760 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 1084 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 1084 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 1084 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 3420 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 3420 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 3420 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe PID 4664 wrote to memory of 388 4664 oDEEOpxV4qBlrgj.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\oDEEOpxV4qBlrgj.exe"C:\Users\Admin\AppData\Local\Temp\oDEEOpxV4qBlrgj.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\oDEEOpxV4qBlrgj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rTYeHpkLYAzXn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rTYeHpkLYAzXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BF0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53693397868b86a5c4b2a4ac90d52278a
SHA119027f5879c069ea8edfc50ecb4701d7ba90112b
SHA256d8c3640fea6ef90df67db030e10af0ffcee07312d8f25779c1b47e41feb77e10
SHA5124e21b989f9427955e6d35cd7ac0a7eeb2e763157fd4f1c1824e2cf50b88f4cb4f466cbb701ba1d374a3de49b0113f9d9b992932bbb191c932262192b7811ef3c
-
C:\Users\Admin\AppData\Local\Temp\tmp3BF0.tmpFilesize
1KB
MD507d755feffe3c6bb4594d57d73e1dac1
SHA19fe49ef8be691462c55146cd47d88f39429269fe
SHA2567a49cab4bace55ba44a7a6ca7a2ae4a6cfe5333a11cb884596c76a4d33fd38a4
SHA512dbf6fa9959a0ba54cd0d77f60abb9c6358b12ee734bcf3c23af4c454eff27872d79e03bfbb5f01dc629963968934ab7d01afab0d9730c739edf6362db94b2b43
-
memory/388-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/388-149-0x0000000000000000-mapping.dmp
-
memory/1084-147-0x0000000000000000-mapping.dmp
-
memory/2760-146-0x0000000000000000-mapping.dmp
-
memory/3360-161-0x0000000007050000-0x000000000706A000-memory.dmpFilesize
104KB
-
memory/3360-138-0x0000000000000000-mapping.dmp
-
memory/3360-152-0x0000000005F60000-0x0000000005F92000-memory.dmpFilesize
200KB
-
memory/3360-154-0x0000000075C40000-0x0000000075C8C000-memory.dmpFilesize
304KB
-
memory/3360-157-0x0000000006D10000-0x0000000006D2A000-memory.dmpFilesize
104KB
-
memory/3360-158-0x0000000006D80000-0x0000000006D8A000-memory.dmpFilesize
40KB
-
memory/3360-144-0x0000000005310000-0x0000000005376000-memory.dmpFilesize
408KB
-
memory/3420-148-0x0000000000000000-mapping.dmp
-
memory/4664-135-0x0000000004C00000-0x0000000004C0A000-memory.dmpFilesize
40KB
-
memory/4664-134-0x0000000004A60000-0x0000000004AF2000-memory.dmpFilesize
584KB
-
memory/4664-136-0x00000000089F0000-0x0000000008A8C000-memory.dmpFilesize
624KB
-
memory/4664-132-0x0000000000010000-0x00000000000B2000-memory.dmpFilesize
648KB
-
memory/4664-133-0x0000000005010000-0x00000000055B4000-memory.dmpFilesize
5.6MB
-
memory/4912-139-0x0000000000000000-mapping.dmp
-
memory/4980-140-0x0000000002A50000-0x0000000002A86000-memory.dmpFilesize
216KB
-
memory/4980-153-0x0000000075C40000-0x0000000075C8C000-memory.dmpFilesize
304KB
-
memory/4980-155-0x00000000068E0000-0x00000000068FE000-memory.dmpFilesize
120KB
-
memory/4980-156-0x0000000007C80000-0x00000000082FA000-memory.dmpFilesize
6.5MB
-
memory/4980-151-0x0000000006320000-0x000000000633E000-memory.dmpFilesize
120KB
-
memory/4980-145-0x0000000005CE0000-0x0000000005D46000-memory.dmpFilesize
408KB
-
memory/4980-159-0x00000000078B0000-0x0000000007946000-memory.dmpFilesize
600KB
-
memory/4980-160-0x0000000007860000-0x000000000786E000-memory.dmpFilesize
56KB
-
memory/4980-143-0x0000000005BA0000-0x0000000005BC2000-memory.dmpFilesize
136KB
-
memory/4980-162-0x0000000007950000-0x0000000007958000-memory.dmpFilesize
32KB
-
memory/4980-141-0x0000000005540000-0x0000000005B68000-memory.dmpFilesize
6.2MB
-
memory/4980-137-0x0000000000000000-mapping.dmp