Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-02-2023 05:28
Static task
static1
Behavioral task
behavioral1
Sample
FUDSilentCrypt.exe
Resource
win7-20220812-en
General
-
Target
FUDSilentCrypt.exe
-
Size
53.0MB
-
MD5
377475407f594a9a3054c3b012b52889
-
SHA1
aab2a193aae478408be5b41f9c24a4d7e7ecf5ff
-
SHA256
73da672e9c1adc2e13625aeb89bcc6f78382ff96ee41c25a6ccb817bc65e8521
-
SHA512
68bce781a24c83713747695a6e19cd38b6066eb8c4866ca91c668190abf07aa99ac07e63059ae0b3c4564b1f7f97c0b818378ff2a2458b9100ef4597db68c89b
-
SSDEEP
6144:Ih0CzEeWuPeZ3NUMOnpTdioT2NeLGp/uwONct43+4gU:W9zEGPeZ3Megce6pGHNu47gU
Malware Config
Extracted
asyncrat
0.5.7B
Default
194.49.94.163:6606
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
RuntimeService.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 12 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Payload.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Payload.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Payload.exe asyncrat behavioral1/memory/2004-60-0x0000000000300000-0x0000000000312000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\RuntimeService.exe asyncrat C:\Users\Admin\AppData\Roaming\RuntimeService.exe asyncrat C:\Users\Admin\AppData\Roaming\RuntimeService.exe asyncrat behavioral1/memory/1680-75-0x0000000001090000-0x00000000010A2000-memory.dmp asyncrat \Users\Admin\AppData\Local\Temp\Payload.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Payload.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Payload.exe asyncrat behavioral1/memory/1928-89-0x0000000000CC0000-0x0000000000CD2000-memory.dmp asyncrat -
Executes dropped EXE 5 IoCs
Processes:
Payload.exeRuntimeService.exeRuntimeService.exePayload.exeRuntimeService.exepid process 2004 Payload.exe 1680 RuntimeService.exe 1912 RuntimeService.exe 1928 Payload.exe 980 RuntimeService.exe -
Loads dropped DLL 3 IoCs
Processes:
FUDSilentCrypt.execmd.exeRuntimeService.exepid process 1884 FUDSilentCrypt.exe 1472 cmd.exe 1912 RuntimeService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1560 schtasks.exe 1276 schtasks.exe 948 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 928 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Payload.exepid process 2004 Payload.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payload.exeRuntimeService.exedescription pid process Token: SeDebugPrivilege 2004 Payload.exe Token: SeDebugPrivilege 1680 RuntimeService.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FUDSilentCrypt.execmd.exePayload.execmd.execmd.exetaskeng.exeRuntimeService.execmd.exedescription pid process target process PID 1884 wrote to memory of 2004 1884 FUDSilentCrypt.exe Payload.exe PID 1884 wrote to memory of 2004 1884 FUDSilentCrypt.exe Payload.exe PID 1884 wrote to memory of 2004 1884 FUDSilentCrypt.exe Payload.exe PID 1884 wrote to memory of 2004 1884 FUDSilentCrypt.exe Payload.exe PID 1884 wrote to memory of 2000 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 2000 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 2000 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 2000 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1648 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1648 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1648 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1648 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1936 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1936 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1936 1884 FUDSilentCrypt.exe cmd.exe PID 1884 wrote to memory of 1936 1884 FUDSilentCrypt.exe cmd.exe PID 1648 wrote to memory of 1560 1648 cmd.exe schtasks.exe PID 1648 wrote to memory of 1560 1648 cmd.exe schtasks.exe PID 1648 wrote to memory of 1560 1648 cmd.exe schtasks.exe PID 1648 wrote to memory of 1560 1648 cmd.exe schtasks.exe PID 2004 wrote to memory of 1756 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1756 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1756 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1756 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1472 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1472 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1472 2004 Payload.exe cmd.exe PID 2004 wrote to memory of 1472 2004 Payload.exe cmd.exe PID 1756 wrote to memory of 1276 1756 cmd.exe schtasks.exe PID 1756 wrote to memory of 1276 1756 cmd.exe schtasks.exe PID 1756 wrote to memory of 1276 1756 cmd.exe schtasks.exe PID 1756 wrote to memory of 1276 1756 cmd.exe schtasks.exe PID 1472 wrote to memory of 928 1472 cmd.exe timeout.exe PID 1472 wrote to memory of 928 1472 cmd.exe timeout.exe PID 1472 wrote to memory of 928 1472 cmd.exe timeout.exe PID 1472 wrote to memory of 928 1472 cmd.exe timeout.exe PID 1472 wrote to memory of 1680 1472 cmd.exe RuntimeService.exe PID 1472 wrote to memory of 1680 1472 cmd.exe RuntimeService.exe PID 1472 wrote to memory of 1680 1472 cmd.exe RuntimeService.exe PID 1472 wrote to memory of 1680 1472 cmd.exe RuntimeService.exe PID 976 wrote to memory of 1912 976 taskeng.exe RuntimeService.exe PID 976 wrote to memory of 1912 976 taskeng.exe RuntimeService.exe PID 976 wrote to memory of 1912 976 taskeng.exe RuntimeService.exe PID 976 wrote to memory of 1912 976 taskeng.exe RuntimeService.exe PID 1912 wrote to memory of 1928 1912 RuntimeService.exe Payload.exe PID 1912 wrote to memory of 1928 1912 RuntimeService.exe Payload.exe PID 1912 wrote to memory of 1928 1912 RuntimeService.exe Payload.exe PID 1912 wrote to memory of 1928 1912 RuntimeService.exe Payload.exe PID 1912 wrote to memory of 1512 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 1512 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 1512 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 1512 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2032 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2032 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2032 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2032 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2028 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2028 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2028 1912 RuntimeService.exe cmd.exe PID 1912 wrote to memory of 2028 1912 RuntimeService.exe cmd.exe PID 2032 wrote to memory of 948 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 948 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 948 2032 cmd.exe schtasks.exe PID 2032 wrote to memory of 948 2032 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUDSilentCrypt.exe"C:\Users\Admin\AppData\Local\Temp\FUDSilentCrypt.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeService" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeService.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeService" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeService.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8872.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\RuntimeService.exe"C:\Users\Admin\AppData\Roaming\RuntimeService.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\RuntimeService"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FUDSilentCrypt.exe" "C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {ABF57960-8BAB-45AF-8BA0-24BB6C6A909C} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exeC:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\RuntimeService"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe" "C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exeC:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Local\Temp\tmp8872.tmp.batFilesize
158B
MD5bb70d363f5d5093a96451276ef0ceb54
SHA184b56aa397e98e32432acea531357e4ee55ad5ac
SHA256a61ebf35cc66ab9db6989b65fbb4ef7877e320d5f9b988d85a141cec54595683
SHA512dcdeeb06a9899c87f8b943611b325082c8aa38763f5a6078e3545265215a63867c2dd0d4f1b91d96008b779e75b13250e1362c790bc3fc4c24036b21be9eadd2
-
C:\Users\Admin\AppData\Roaming\RuntimeService.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Roaming\RuntimeService.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exeFilesize
53.0MB
MD5377475407f594a9a3054c3b012b52889
SHA1aab2a193aae478408be5b41f9c24a4d7e7ecf5ff
SHA25673da672e9c1adc2e13625aeb89bcc6f78382ff96ee41c25a6ccb817bc65e8521
SHA51268bce781a24c83713747695a6e19cd38b6066eb8c4866ca91c668190abf07aa99ac07e63059ae0b3c4564b1f7f97c0b818378ff2a2458b9100ef4597db68c89b
-
C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exeFilesize
53.0MB
MD5377475407f594a9a3054c3b012b52889
SHA1aab2a193aae478408be5b41f9c24a4d7e7ecf5ff
SHA25673da672e9c1adc2e13625aeb89bcc6f78382ff96ee41c25a6ccb817bc65e8521
SHA51268bce781a24c83713747695a6e19cd38b6066eb8c4866ca91c668190abf07aa99ac07e63059ae0b3c4564b1f7f97c0b818378ff2a2458b9100ef4597db68c89b
-
C:\Users\Admin\AppData\Roaming\RuntimeService\RuntimeService.exeFilesize
53.0MB
MD5377475407f594a9a3054c3b012b52889
SHA1aab2a193aae478408be5b41f9c24a4d7e7ecf5ff
SHA25673da672e9c1adc2e13625aeb89bcc6f78382ff96ee41c25a6ccb817bc65e8521
SHA51268bce781a24c83713747695a6e19cd38b6066eb8c4866ca91c668190abf07aa99ac07e63059ae0b3c4564b1f7f97c0b818378ff2a2458b9100ef4597db68c89b
-
\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
\Users\Admin\AppData\Local\Temp\Payload.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
\Users\Admin\AppData\Roaming\RuntimeService.exeFilesize
45KB
MD53dfaaf4e5b35b91fc538c9dc5c60b744
SHA1493e9bf280746ffb2e8e95c0e5c14bb031fc9548
SHA25665b334e703494d3e8594c706a128e13e0a6b06f4d4f822fa1553f82c161f986c
SHA51218b44f89ac4a7078c9a4bcb811f3ffe8276bb81ae6adebc30122ea5bb0a975dcca553b3f9580b51288c4d7c40191910c639a7b6a5474905833cf7305770c16b5
-
memory/928-70-0x0000000000000000-mapping.dmp
-
memory/948-90-0x0000000000000000-mapping.dmp
-
memory/980-92-0x0000000000000000-mapping.dmp
-
memory/1276-69-0x0000000000000000-mapping.dmp
-
memory/1472-67-0x0000000000000000-mapping.dmp
-
memory/1512-84-0x0000000000000000-mapping.dmp
-
memory/1560-64-0x0000000000000000-mapping.dmp
-
memory/1648-62-0x0000000000000000-mapping.dmp
-
memory/1680-73-0x0000000000000000-mapping.dmp
-
memory/1680-75-0x0000000001090000-0x00000000010A2000-memory.dmpFilesize
72KB
-
memory/1756-66-0x0000000000000000-mapping.dmp
-
memory/1884-54-0x0000000001290000-0x00000000012DA000-memory.dmpFilesize
296KB
-
memory/1884-55-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/1912-78-0x0000000000000000-mapping.dmp
-
memory/1912-80-0x00000000011E0000-0x000000000122A000-memory.dmpFilesize
296KB
-
memory/1928-83-0x0000000000000000-mapping.dmp
-
memory/1928-89-0x0000000000CC0000-0x0000000000CD2000-memory.dmpFilesize
72KB
-
memory/1936-63-0x0000000000000000-mapping.dmp
-
memory/2000-61-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x0000000000300000-0x0000000000312000-memory.dmpFilesize
72KB
-
memory/2004-57-0x0000000000000000-mapping.dmp
-
memory/2028-87-0x0000000000000000-mapping.dmp
-
memory/2032-85-0x0000000000000000-mapping.dmp