Analysis
-
max time kernel
107s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 10:40
Static task
static1
Behavioral task
behavioral1
Sample
document_viewer.exe
Resource
win7-20221111-en
General
-
Target
document_viewer.exe
-
Size
580KB
-
MD5
bc1722ec205a1c5ed34b8766971fe608
-
SHA1
43ded76bf48088b7684879214ad4d66b58ef9a90
-
SHA256
325076c547bffb21683f5bc023739016ad025c0739a7e122aa7289fa91fc88c2
-
SHA512
9eee2a624c14281de538b34032457c53276c3dad67b89989e7f95a3e93dae05e87bda13791aa00d8928d4a9845879d164ff900084ad5a120db44e934b0f89465
-
SSDEEP
12288:bIqDSu4Dsv9thG2SEzak3cgH+/nSsYCrDl0wnhkDsv9t:MqDSu8gLY/nWiuY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.0
Default
179.43.142.197:5789
ncarwpqkcbklyda
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/8-147-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
document_viewer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation document_viewer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
document_viewer.exedescription pid process target process PID 4984 set thread context of 8 4984 document_viewer.exe document_viewer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
document_viewer.exepowershell.exepowershell.exedocument_viewer.exepid process 4984 document_viewer.exe 4724 powershell.exe 3036 powershell.exe 4984 document_viewer.exe 3036 powershell.exe 4724 powershell.exe 8 document_viewer.exe 8 document_viewer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
document_viewer.exepowershell.exepowershell.exedocument_viewer.exedescription pid process Token: SeDebugPrivilege 4984 document_viewer.exe Token: SeDebugPrivilege 3036 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 8 document_viewer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
document_viewer.exepid process 8 document_viewer.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
document_viewer.exedescription pid process target process PID 4984 wrote to memory of 4724 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 4724 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 4724 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 3036 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 3036 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 3036 4984 document_viewer.exe powershell.exe PID 4984 wrote to memory of 3336 4984 document_viewer.exe schtasks.exe PID 4984 wrote to memory of 3336 4984 document_viewer.exe schtasks.exe PID 4984 wrote to memory of 3336 4984 document_viewer.exe schtasks.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe PID 4984 wrote to memory of 8 4984 document_viewer.exe document_viewer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sDCoBOTNA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sDCoBOTNA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp179F.tmp"2⤵
- Creates scheduled task(s)
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:8
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD54faaac7bd2472ea685cdb3d233886646
SHA1ac59e490f54400b0457de9aff03bb8c14a44395c
SHA256713b0140a2475ba4cdc4e701cede46631ca29977a847ec8451b7093353b0c7d9
SHA5125f3eb1da42660acd0ffc1f4ea6d10662d4d6bffe17925a7e6526b31f10c01aabdc38323dfd1a747a93b55e560d554959c65e1649f2e2f7ea0eb8eba4f5105f43
-
C:\Users\Admin\AppData\Local\Temp\tmp179F.tmpFilesize
1KB
MD5100aa8c0c1096bbd4f089b4363d0c448
SHA108b5de7aa0d146b52a98334e57f9b3a5ed22f169
SHA25625f4079d5c917a6c7bbae6b224cc53f8199fdd796c682c162d76bf54043b0cc3
SHA5128e22f5febea21e7d925d91dee099bdbd0d02d6b852ff02c2f82428cc75a2edcb41f8a78aaeda5b2d1642572455bdafaac61627c47e15c96fef63c7e2b0f3e202
-
memory/8-163-0x0000000006F20000-0x0000000006F3E000-memory.dmpFilesize
120KB
-
memory/8-162-0x0000000006F60000-0x0000000006FD6000-memory.dmpFilesize
472KB
-
memory/8-147-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/8-146-0x0000000000000000-mapping.dmp
-
memory/3036-154-0x0000000006DD0000-0x0000000006DEA000-memory.dmpFilesize
104KB
-
memory/3036-148-0x0000000005AC0000-0x0000000005ADE000-memory.dmpFilesize
120KB
-
memory/3036-150-0x00000000757C0000-0x000000007580C000-memory.dmpFilesize
304KB
-
memory/3036-157-0x0000000007000000-0x000000000700E000-memory.dmpFilesize
56KB
-
memory/3036-144-0x00000000053C0000-0x0000000005426000-memory.dmpFilesize
408KB
-
memory/3036-149-0x0000000006AB0000-0x0000000006AE2000-memory.dmpFilesize
200KB
-
memory/3036-145-0x0000000005430000-0x0000000005496000-memory.dmpFilesize
408KB
-
memory/3036-138-0x0000000000000000-mapping.dmp
-
memory/3036-159-0x00000000070F0000-0x00000000070F8000-memory.dmpFilesize
32KB
-
memory/3336-140-0x0000000000000000-mapping.dmp
-
memory/4724-155-0x0000000007BA0000-0x0000000007BAA000-memory.dmpFilesize
40KB
-
memory/4724-139-0x0000000002F30000-0x0000000002F66000-memory.dmpFilesize
216KB
-
memory/4724-152-0x0000000006DC0000-0x0000000006DDE000-memory.dmpFilesize
120KB
-
memory/4724-141-0x0000000005A50000-0x0000000006078000-memory.dmpFilesize
6.2MB
-
memory/4724-153-0x0000000008170000-0x00000000087EA000-memory.dmpFilesize
6.5MB
-
memory/4724-137-0x0000000000000000-mapping.dmp
-
memory/4724-151-0x00000000757C0000-0x000000007580C000-memory.dmpFilesize
304KB
-
memory/4724-156-0x0000000007DB0000-0x0000000007E46000-memory.dmpFilesize
600KB
-
memory/4724-143-0x00000000059E0000-0x0000000005A02000-memory.dmpFilesize
136KB
-
memory/4724-158-0x0000000007E70000-0x0000000007E8A000-memory.dmpFilesize
104KB
-
memory/4984-132-0x0000000000860000-0x00000000008F8000-memory.dmpFilesize
608KB
-
memory/4984-136-0x0000000007F90000-0x000000000802C000-memory.dmpFilesize
624KB
-
memory/4984-135-0x0000000005460000-0x000000000546A000-memory.dmpFilesize
40KB
-
memory/4984-134-0x00000000052D0000-0x0000000005362000-memory.dmpFilesize
584KB
-
memory/4984-133-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB