Analysis
- max time kernel
24s - max time network
26s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
09/03/2023, 22:38
Behavioral task
behavioral1
Sample
AMAZON generator.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
- Target AMAZON generator.exe
- Size 57KB
- Sample230309-2kkbsaae96
- SHA256 08cc1e008aa8af68c0e8c403c0ebc06a74d8a0a061d6e2c4a8a2b81bf84a1251
- MD5 aa52d9f511487792583a6e9eec56ff20
- SHA1 978dea41dbcc6815b4f1d8607374363611780a08
- SHA512 bb308b4e53b5f4f2ba228fc4d359f93fccf1624a5ed1c05d90f5277c643e999b7626defe335756699f12e2f74e72ffdc31283a6bfb015dd483ccb1172aebcef1
- SSDEEP 1536:xu6cdTAu425IN33/3bAXLh7fbZqvd0v0UzD4:xu6ITAu42qN33/3bA97fbEvHUzD4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
true
-
install_file
Gen.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2548-133-0x0000000000840000-0x0000000000854000-memory.dmp asyncrat behavioral2/files/0x00030000000227ba-142.dat asyncrat behavioral2/files/0x00030000000227ba-143.dat asyncrat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation AMAZON generator.exe - Executes dropped EXE 1 IoCs
pid Process 4900 Gen.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4224 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4200 timeout.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 2548 AMAZON generator.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2548 AMAZON generator.exe Token: SeDebugPrivilege 1048 taskmgr.exe Token: SeSystemProfilePrivilege 1048 taskmgr.exe Token: SeCreateGlobalPrivilege 1048 taskmgr.exe Token: SeDebugPrivilege 4900 Gen.exe Token: 33 1048 taskmgr.exe Token: SeIncBasePriorityPrivilege 1048 taskmgr.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2548 wrote to memory of 4644 2548 AMAZON generator.exe 91 PID 2548 wrote to memory of 4644 2548 AMAZON generator.exe 91 PID 2548 wrote to memory of 4644 2548 AMAZON generator.exe 91 PID 2548 wrote to memory of 1480 2548 AMAZON generator.exe 93 PID 2548 wrote to memory of 1480 2548 AMAZON generator.exe 93 PID 2548 wrote to memory of 1480 2548 AMAZON generator.exe 93 PID 4644 wrote to memory of 4224 4644 cmd.exe 95 PID 4644 wrote to memory of 4224 4644 cmd.exe 95 PID 4644 wrote to memory of 4224 4644 cmd.exe 95 PID 1480 wrote to memory of 4200 1480 cmd.exe 96 PID 1480 wrote to memory of 4200 1480 cmd.exe 96 PID 1480 wrote to memory of 4200 1480 cmd.exe 96 PID 1480 wrote to memory of 4900 1480 cmd.exe 101 PID 1480 wrote to memory of 4900 1480 cmd.exe 101 PID 1480 wrote to memory of 4900 1480 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\AMAZON generator.exe"C:\Users\Admin\AppData\Local\Temp\AMAZON generator.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gen" /tr '"C:\Users\Admin\AppData\Roaming\Gen.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Gen" /tr '"C:\Users\Admin\AppData\Roaming\Gen.exe"'3⤵
- Creates scheduled task(s)
PID:4224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF1F6.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4200
-
-
C:\Users\Admin\AppData\Roaming\Gen.exe"C:\Users\Admin\AppData\Roaming\Gen.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpF1F6.tmp.bat
- Size 147B
- SHA256 24ae94aeeb7027224b2ff53f30b86c11a865c9afa5e6624cf60b3ad0bf894d3a
- MD5 3afaa0b8288a8c588fa308829469eb52
- SHA1 ba9f4f2fcc1b84264ca594f7da5ad1d5c1da20f8
- SHA512 6345881d97e64fbf2325eafd8dc4c7a9c89fc4b293bd67e13255f76bc3b9f18240b1c77e79a0432ca61cdb986343f64789f6cd27114ff49ac5d15085c69fff7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Gen.exe
- Size 57KB
- SHA256 08cc1e008aa8af68c0e8c403c0ebc06a74d8a0a061d6e2c4a8a2b81bf84a1251
- MD5 aa52d9f511487792583a6e9eec56ff20
- SHA1 978dea41dbcc6815b4f1d8607374363611780a08
- SHA512 bb308b4e53b5f4f2ba228fc4d359f93fccf1624a5ed1c05d90f5277c643e999b7626defe335756699f12e2f74e72ffdc31283a6bfb015dd483ccb1172aebcef1
- SSDEEP 1536:xu6cdTAu425IN33/3bAXLh7fbZqvd0v0UzD4:xu6ITAu42qN33/3bA97fbEvHUzD4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Gen.exe
- Size 57KB
- SHA256 08cc1e008aa8af68c0e8c403c0ebc06a74d8a0a061d6e2c4a8a2b81bf84a1251
- MD5 aa52d9f511487792583a6e9eec56ff20
- SHA1 978dea41dbcc6815b4f1d8607374363611780a08
- SHA512 bb308b4e53b5f4f2ba228fc4d359f93fccf1624a5ed1c05d90f5277c643e999b7626defe335756699f12e2f74e72ffdc31283a6bfb015dd483ccb1172aebcef1
- SSDEEP 1536:xu6cdTAu425IN33/3bAXLh7fbZqvd0v0UzD4:xu6ITAu42qN33/3bA97fbEvHUzD4
- MD5 SHA1 SHA512 SSDEEP