Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
18-02-2023 22:17
Static task
static1
Behavioral task
behavioral1
Sample
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe
Resource
win7-20221111-en
General
-
Target
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe
-
Size
591KB
-
MD5
401240d7a40901b74d85ac7620b83915
-
SHA1
3f512a8ff2f7d143a14badbc6191c3b8e09d23f6
-
SHA256
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7
-
SHA512
996da140a45b98cfd0e8f803037296b1b73cb01793c6302784d2bd1ae6fb3a58b17f171e6eefd406b73637457031fb1363ff9c2f97ca6eaeb71a51c1bd0f5cd2
-
SSDEEP
12288:Yr8m6f8WlGdAGUow9aR9IlzTmKa188LY1dPijURkY6z7ZIahRZ5GcrO:bIeG5IHgoiqjqZIS5GcrO
Malware Config
Extracted
asyncrat
0.5.7B
Default
100.42.65.218:8080
100.42.65.218:6606
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
winsyd.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3392-258-0x000000000040C71E-mapping.dmp asyncrat behavioral2/memory/3392-315-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exedescription pid process target process PID 2716 set thread context of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exepowershell.exepid process 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe 3512 powershell.exe 3512 powershell.exe 3512 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exepowershell.exedescription pid process Token: SeDebugPrivilege 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe Token: SeDebugPrivilege 3512 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exedescription pid process target process PID 2716 wrote to memory of 3512 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe powershell.exe PID 2716 wrote to memory of 3512 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe powershell.exe PID 2716 wrote to memory of 3512 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe powershell.exe PID 2716 wrote to memory of 2620 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe schtasks.exe PID 2716 wrote to memory of 2620 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe schtasks.exe PID 2716 wrote to memory of 2620 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe schtasks.exe PID 2716 wrote to memory of 4516 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 4516 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 4516 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe PID 2716 wrote to memory of 3392 2716 d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe"C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LGlGutVnWHPDKx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGlGutVnWHPDKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D2A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9D2A.tmpFilesize
1KB
MD5f990112ea6daf337abf0a5cdb75a6687
SHA1d557b630c1bfb1d160139a65827ab601711c581d
SHA256f82c5718394aa7f822664306d30d4d8637477036db671451ccb5fd66e6e8432a
SHA51250c9b9b2b99d2390644823035ef707a46141ade4a3344a0f815557aeff99c61a699375918f8dcf5dec0ff99d51dea92e005825f9aaee2ee27685af7a586ada3a
-
memory/2620-203-0x0000000000000000-mapping.dmp
-
memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-120-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-123-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-150-0x0000000000C30000-0x0000000000CC8000-memory.dmpFilesize
608KB
-
memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-180-0x0000000005560000-0x0000000005578000-memory.dmpFilesize
96KB
-
memory/2716-181-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/2716-182-0x0000000005900000-0x000000000599C000-memory.dmpFilesize
624KB
-
memory/2716-183-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-185-0x0000000005C80000-0x0000000005CEE000-memory.dmpFilesize
440KB
-
memory/2716-186-0x00000000061F0000-0x00000000066EE000-memory.dmpFilesize
5.0MB
-
memory/2716-188-0x0000000005D00000-0x0000000006050000-memory.dmpFilesize
3.3MB
-
memory/2716-253-0x0000000006090000-0x00000000060A4000-memory.dmpFilesize
80KB
-
memory/3392-258-0x000000000040C71E-mapping.dmp
-
memory/3392-315-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3512-200-0x0000000000000000-mapping.dmp
-
memory/3512-260-0x0000000006930000-0x0000000006966000-memory.dmpFilesize
216KB
-
memory/3512-274-0x0000000006FA0000-0x00000000075C8000-memory.dmpFilesize
6.2MB
-
memory/3512-320-0x0000000007750000-0x0000000007772000-memory.dmpFilesize
136KB
-
memory/3512-321-0x0000000007950000-0x00000000079B6000-memory.dmpFilesize
408KB
-
memory/3512-322-0x0000000007690000-0x00000000076F6000-memory.dmpFilesize
408KB
-
memory/3512-323-0x0000000007A80000-0x0000000007DD0000-memory.dmpFilesize
3.3MB
-
memory/3512-326-0x00000000078A0000-0x00000000078BC000-memory.dmpFilesize
112KB
-
memory/3512-327-0x00000000082A0000-0x00000000082EB000-memory.dmpFilesize
300KB
-
memory/3512-331-0x0000000008010000-0x0000000008086000-memory.dmpFilesize
472KB
-
memory/3512-344-0x0000000009160000-0x0000000009193000-memory.dmpFilesize
204KB
-
memory/3512-345-0x0000000009120000-0x000000000913E000-memory.dmpFilesize
120KB
-
memory/3512-354-0x0000000009290000-0x0000000009335000-memory.dmpFilesize
660KB
-
memory/3512-358-0x0000000009460000-0x00000000094F4000-memory.dmpFilesize
592KB
-
memory/3512-578-0x0000000006C00000-0x0000000006C1A000-memory.dmpFilesize
104KB
-
memory/3512-583-0x0000000006BF0000-0x0000000006BF8000-memory.dmpFilesize
32KB