Analysis
-
max time kernel
73s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 10:36
Static task
static1
Behavioral task
behavioral1
Sample
document_viewer.exe
Resource
win7-20220812-en
General
-
Target
document_viewer.exe
-
Size
580KB
-
MD5
bc1722ec205a1c5ed34b8766971fe608
-
SHA1
43ded76bf48088b7684879214ad4d66b58ef9a90
-
SHA256
325076c547bffb21683f5bc023739016ad025c0739a7e122aa7289fa91fc88c2
-
SHA512
9eee2a624c14281de538b34032457c53276c3dad67b89989e7f95a3e93dae05e87bda13791aa00d8928d4a9845879d164ff900084ad5a120db44e934b0f89465
-
SSDEEP
12288:bIqDSu4Dsv9thG2SEzak3cgH+/nSsYCrDl0wnhkDsv9t:MqDSu8gLY/nWiuY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.0
Default
179.43.142.197:5789
ncarwpqkcbklyda
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4664-147-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
document_viewer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation document_viewer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
document_viewer.exedescription pid process target process PID 980 set thread context of 4664 980 document_viewer.exe document_viewer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
document_viewer.exepowershell.exepowershell.exedocument_viewer.exepid process 980 document_viewer.exe 3384 powershell.exe 628 powershell.exe 980 document_viewer.exe 3384 powershell.exe 628 powershell.exe 4664 document_viewer.exe 4664 document_viewer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
document_viewer.exepowershell.exepowershell.exedocument_viewer.exedescription pid process Token: SeDebugPrivilege 980 document_viewer.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeDebugPrivilege 4664 document_viewer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
document_viewer.exepid process 4664 document_viewer.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
document_viewer.exedescription pid process target process PID 980 wrote to memory of 628 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 628 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 628 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 3384 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 3384 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 3384 980 document_viewer.exe powershell.exe PID 980 wrote to memory of 4568 980 document_viewer.exe schtasks.exe PID 980 wrote to memory of 4568 980 document_viewer.exe schtasks.exe PID 980 wrote to memory of 4568 980 document_viewer.exe schtasks.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe PID 980 wrote to memory of 4664 980 document_viewer.exe document_viewer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sDCoBOTNA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sDCoBOTNA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3038.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5451ef62cd72fd897630ab21b77b85224
SHA1ed2499af5685d1105b5230b4c537726660435245
SHA2564b60e388e0b847096de39e517304a3426685c2ef88f1a0a953d64d40b9ce8bd8
SHA512c787e034a83e647a787ab5d0d95f12e0fb8a89017cd70101476e23c6e8f94c64642fe21743b572ccefd305c82314676f902f8ac32fa95f0244d6a35030e605c5
-
C:\Users\Admin\AppData\Local\Temp\tmp3038.tmpFilesize
1KB
MD5ddca58a1c15e3ff61f4203ee575903c4
SHA18372df54dd111a13f9751f154901c2c37c4c6e30
SHA256df9fe61f57c42627e908b644ff23162834c87619f793d9be16ebf27f2d4c598c
SHA5124bbea187ab30caa7ab1eb96973a68c9638470e1e1c11442711189c12d161ae83ae8ccbe2cfe0d5a6cff9a5c3723e5e8a13dbf995d7e299258aea124d0f2bd07b
-
memory/628-156-0x0000000007660000-0x00000000076F6000-memory.dmpFilesize
600KB
-
memory/628-145-0x0000000005950000-0x00000000059B6000-memory.dmpFilesize
408KB
-
memory/628-150-0x0000000075830000-0x000000007587C000-memory.dmpFilesize
304KB
-
memory/628-153-0x0000000007A30000-0x00000000080AA000-memory.dmpFilesize
6.5MB
-
memory/628-137-0x0000000000000000-mapping.dmp
-
memory/628-140-0x0000000002810000-0x0000000002846000-memory.dmpFilesize
216KB
-
memory/628-141-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/628-155-0x0000000007460000-0x000000000746A000-memory.dmpFilesize
40KB
-
memory/628-144-0x00000000052A0000-0x0000000005306000-memory.dmpFilesize
408KB
-
memory/980-134-0x00000000057E0000-0x0000000005872000-memory.dmpFilesize
584KB
-
memory/980-136-0x00000000084E0000-0x000000000857C000-memory.dmpFilesize
624KB
-
memory/980-132-0x0000000000DA0000-0x0000000000E38000-memory.dmpFilesize
608KB
-
memory/980-135-0x00000000058A0000-0x00000000058AA000-memory.dmpFilesize
40KB
-
memory/980-133-0x0000000005E70000-0x0000000006414000-memory.dmpFilesize
5.6MB
-
memory/3384-157-0x0000000007C00000-0x0000000007C0E000-memory.dmpFilesize
56KB
-
memory/3384-151-0x0000000075830000-0x000000007587C000-memory.dmpFilesize
304KB
-
memory/3384-138-0x0000000000000000-mapping.dmp
-
memory/3384-152-0x0000000006C90000-0x0000000006CAE000-memory.dmpFilesize
120KB
-
memory/3384-148-0x00000000066D0000-0x00000000066EE000-memory.dmpFilesize
120KB
-
memory/3384-154-0x00000000079D0000-0x00000000079EA000-memory.dmpFilesize
104KB
-
memory/3384-149-0x0000000006CD0000-0x0000000006D02000-memory.dmpFilesize
200KB
-
memory/3384-159-0x0000000007CF0000-0x0000000007CF8000-memory.dmpFilesize
32KB
-
memory/3384-143-0x0000000005F50000-0x0000000005F72000-memory.dmpFilesize
136KB
-
memory/3384-158-0x0000000007D10000-0x0000000007D2A000-memory.dmpFilesize
104KB
-
memory/4568-139-0x0000000000000000-mapping.dmp
-
memory/4664-147-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/4664-146-0x0000000000000000-mapping.dmp
-
memory/4664-162-0x0000000006D20000-0x0000000006D96000-memory.dmpFilesize
472KB
-
memory/4664-163-0x0000000006CF0000-0x0000000006D0E000-memory.dmpFilesize
120KB