Analysis

  • max time kernel
    94s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-02-2023 19:30

General

  • Target

    SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe

  • Size

    621KB

  • MD5

    45f42e17dd7229140a940f3346ddf3a9

  • SHA1

    dbf51050b80bd2932bfed81fc867495bbd856ca6

  • SHA256

    785ebeb84c2bc65d0b0a55691f18631c110531b132f60535b8462684d2492b81

  • SHA512

    3a1c2a3ee5382c61759e1a2664f2871eb49c567de6dec8ad70e797d4698f7950ec78eb567aba3ad286723bae926856509e880777d4165a75cc2463fcb4fbc7ef

  • SSDEEP

    12288:NeHlPTZh6q6/TKPzG7rjkKzG9DP+ogIGdjPETxpj:NeHllY/TKPzG7+B+TIOjPWxF

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

192.3.193.136:2023

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rTYeHpkLYAzXn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rTYeHpkLYAzXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56CB.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    82b4f3ce548be8dda3ffaceaeea2d600

    SHA1

    12effe54a9bbc1152e1b7d3e770fd0d436a40360

    SHA256

    20e1616662fd31d1fc923f3c3c0c21952f83ea8f1e007c952e1319e662bf0fd7

    SHA512

    491d5a968ce1be5fdafb84f49fd7e2dc828c100481bfb5d02f154ab3cecd608b298f2c46f57cd2fd9c6ca4524c41d532caaeff673a1dfa97ecbd7aa2d69bf1e9

  • C:\Users\Admin\AppData\Local\Temp\tmp56CB.tmp
    Filesize

    1KB

    MD5

    07d755feffe3c6bb4594d57d73e1dac1

    SHA1

    9fe49ef8be691462c55146cd47d88f39429269fe

    SHA256

    7a49cab4bace55ba44a7a6ca7a2ae4a6cfe5333a11cb884596c76a4d33fd38a4

    SHA512

    dbf6fa9959a0ba54cd0d77f60abb9c6358b12ee734bcf3c23af4c454eff27872d79e03bfbb5f01dc629963968934ab7d01afab0d9730c739edf6362db94b2b43

  • memory/716-133-0x0000000005680000-0x0000000005C24000-memory.dmp
    Filesize

    5.6MB

  • memory/716-134-0x0000000004FF0000-0x0000000005082000-memory.dmp
    Filesize

    584KB

  • memory/716-135-0x00000000050B0000-0x00000000050BA000-memory.dmp
    Filesize

    40KB

  • memory/716-136-0x0000000008FD0000-0x000000000906C000-memory.dmp
    Filesize

    624KB

  • memory/716-132-0x00000000006F0000-0x0000000000792000-memory.dmp
    Filesize

    648KB

  • memory/1636-147-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1636-146-0x0000000000000000-mapping.dmp
  • memory/2136-140-0x0000000000C40000-0x0000000000C76000-memory.dmp
    Filesize

    216KB

  • memory/2136-154-0x0000000006CF0000-0x0000000006D0A000-memory.dmp
    Filesize

    104KB

  • memory/2136-137-0x0000000000000000-mapping.dmp
  • memory/2136-145-0x0000000004B30000-0x0000000004B96000-memory.dmp
    Filesize

    408KB

  • memory/2136-141-0x0000000004BE0000-0x0000000005208000-memory.dmp
    Filesize

    6.2MB

  • memory/2136-143-0x0000000004A20000-0x0000000004A42000-memory.dmp
    Filesize

    136KB

  • memory/2136-148-0x00000000059E0000-0x00000000059FE000-memory.dmp
    Filesize

    120KB

  • memory/2136-159-0x0000000007010000-0x0000000007018000-memory.dmp
    Filesize

    32KB

  • memory/2136-150-0x0000000075360000-0x00000000753AC000-memory.dmp
    Filesize

    304KB

  • memory/2136-151-0x0000000006960000-0x000000000697E000-memory.dmp
    Filesize

    120KB

  • memory/2136-158-0x0000000007030000-0x000000000704A000-memory.dmp
    Filesize

    104KB

  • memory/2136-157-0x0000000006F20000-0x0000000006F2E000-memory.dmp
    Filesize

    56KB

  • memory/4100-139-0x0000000000000000-mapping.dmp
  • memory/4336-155-0x0000000007120000-0x000000000712A000-memory.dmp
    Filesize

    40KB

  • memory/4336-156-0x0000000007330000-0x00000000073C6000-memory.dmp
    Filesize

    600KB

  • memory/4336-153-0x00000000076F0000-0x0000000007D6A000-memory.dmp
    Filesize

    6.5MB

  • memory/4336-152-0x0000000075360000-0x00000000753AC000-memory.dmp
    Filesize

    304KB

  • memory/4336-149-0x00000000063A0000-0x00000000063D2000-memory.dmp
    Filesize

    200KB

  • memory/4336-138-0x0000000000000000-mapping.dmp
  • memory/4336-144-0x00000000054E0000-0x0000000005546000-memory.dmp
    Filesize

    408KB