Analysis Overview
SHA256
6573a46dcc3f3695b69d5f395bc71515b34890ddc4a73b017afab37421512542
Threat Level: Known bad
The file service_updated.exe was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Async RAT payload
Downloads MZ/PE file
Sets file to hidden
Checks computer location settings
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Program crash
Enumerates physical storage devices
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Uses Task Scheduler COM API
Delays execution with timeout.exe
Modifies registry class
Views/modifies file attributes
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-15 00:43
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2023-03-15 00:43
Reported
2023-03-15 00:46
Platform
win10v2004-20230220-en
Max time kernel
143s
Max time network
148s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Downloads MZ/PE file
Sets file to hidden
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\csrss.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\csrss.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\csrss.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\service_updated.exe
"C:\Users\Admin\AppData\Local\Temp\service_updated.exe"
C:\Windows\system32\attrib.exe
"C:\Windows\system32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe
C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe
"C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe"
C:\Users\Admin\AppData\Local\Temp\csrss.exe
"C:\Users\Admin\AppData\Local\Temp\csrss.exe"
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"' & exit
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.bat""
C:\Windows\system32\timeout.exe
timeout 3
C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"'
C:\Users\Admin\AppData\Roaming\csrss.exe
"C:\Users\Admin\AppData\Roaming\csrss.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.38.195.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.68.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | 143.68.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.133.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 104.20.68.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 7.tcp.eu.ngrok.io | udp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| FR | 40.79.141.152:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 131.253.33.203:80 | tcp | |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 203.151.224.20.in-addr.arpa | udp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| US | 93.184.220.29:80 | tcp | |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 75.239.32.23.in-addr.arpa | udp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 35.157.111.131:16394 | 7.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.tcp.eu.ngrok.io | udp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 199.176.139.52.in-addr.arpa | udp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
| DE | 3.125.188.168:16394 | 7.tcp.eu.ngrok.io | tcp |
Files
memory/820-133-0x0000000000BA0000-0x0000000000BAC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjhsb0sk.vqd.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/820-143-0x000000001B760000-0x000000001B770000-memory.dmp
memory/820-144-0x000000001B6A0000-0x000000001B6C2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe
| MD5 | 83a24ea1847f5cbb5508785abb5126ea |
| SHA1 | 63930e7171d1fc94fd4ec745392b3a1136cb0496 |
| SHA256 | 246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268 |
| SHA512 | fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e |
C:\Users\Admin\AppData\Local\Temp\tmp6DD7.exe
| MD5 | 83a24ea1847f5cbb5508785abb5126ea |
| SHA1 | 63930e7171d1fc94fd4ec745392b3a1136cb0496 |
| SHA256 | 246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268 |
| SHA512 | fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e |
memory/2904-149-0x0000000000400000-0x000000000064E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\csrss.exe
| MD5 | 4e8ed7a82d6919108934eaa3fcd3ed9f |
| SHA1 | f74a1c9fc02c8374ec0ee68438ae309f1f61ff41 |
| SHA256 | c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364 |
| SHA512 | 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad |
C:\Users\Admin\AppData\Local\Temp\csrss.exe
| MD5 | 4e8ed7a82d6919108934eaa3fcd3ed9f |
| SHA1 | f74a1c9fc02c8374ec0ee68438ae309f1f61ff41 |
| SHA256 | c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364 |
| SHA512 | 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad |
C:\Users\Admin\AppData\Local\Temp\csrss.exe
| MD5 | 4e8ed7a82d6919108934eaa3fcd3ed9f |
| SHA1 | f74a1c9fc02c8374ec0ee68438ae309f1f61ff41 |
| SHA256 | c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364 |
| SHA512 | 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad |
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
| MD5 | ec801a7d4b72a288ec6c207bb9ff0131 |
| SHA1 | 32eec2ae1f9e201516fa7fcdc16c4928f7997561 |
| SHA256 | b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46 |
| SHA512 | a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac |
memory/2548-229-0x0000000000DF0000-0x0000000000E06000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
| MD5 | ec801a7d4b72a288ec6c207bb9ff0131 |
| SHA1 | 32eec2ae1f9e201516fa7fcdc16c4928f7997561 |
| SHA256 | b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46 |
| SHA512 | a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac |
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
| MD5 | ec801a7d4b72a288ec6c207bb9ff0131 |
| SHA1 | 32eec2ae1f9e201516fa7fcdc16c4928f7997561 |
| SHA256 | b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46 |
| SHA512 | a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac |
memory/4628-288-0x0000000000750000-0x0000000000936000-memory.dmp
memory/4628-289-0x000000001B640000-0x000000001B650000-memory.dmp
memory/4628-290-0x000000001B670000-0x000000001B682000-memory.dmp
memory/4628-291-0x000000001EA10000-0x000000001EA4C000-memory.dmp
memory/4628-293-0x000000001B640000-0x000000001B650000-memory.dmp
memory/4628-294-0x000000001B640000-0x000000001B650000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.bat
| MD5 | 9844dbcd75df1529186eee44640fa766 |
| SHA1 | d882d1ca7277fd862ba986f1fc1cf108a75befba |
| SHA256 | ec46866731f7a578c32a9d8bb70e1a33b25cdd8c65f412672196192b8e3b2339 |
| SHA512 | 529eb729c3a0d0a3dc281faba6447bf81db7d87b08e9458c96dce16851cfecb8c0621d13c35c1054198e8c7d0819396956554154c991091e426183736d1b3544 |
C:\Users\Admin\AppData\Roaming\csrss.exe
| MD5 | 4e8ed7a82d6919108934eaa3fcd3ed9f |
| SHA1 | f74a1c9fc02c8374ec0ee68438ae309f1f61ff41 |
| SHA256 | c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364 |
| SHA512 | 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad |
C:\Users\Admin\AppData\Roaming\csrss.exe
| MD5 | 4e8ed7a82d6919108934eaa3fcd3ed9f |
| SHA1 | f74a1c9fc02c8374ec0ee68438ae309f1f61ff41 |
| SHA256 | c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364 |
| SHA512 | 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
| MD5 | fff5cbccb6b31b40f834b8f4778a779a |
| SHA1 | 899ed0377e89f1ed434cfeecc5bc0163ebdf0454 |
| SHA256 | b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76 |
| SHA512 | 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9 |
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-15 00:43
Reported
2023-03-15 00:46
Platform
win7-20230220-en
Max time kernel
28s
Max time network
30s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\service_updated.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1340 wrote to memory of 1076 | N/A | C:\Users\Admin\AppData\Local\Temp\service_updated.exe | C:\Windows\system32\WerFault.exe |
| PID 1340 wrote to memory of 1076 | N/A | C:\Users\Admin\AppData\Local\Temp\service_updated.exe | C:\Windows\system32\WerFault.exe |
| PID 1340 wrote to memory of 1076 | N/A | C:\Users\Admin\AppData\Local\Temp\service_updated.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\service_updated.exe
"C:\Users\Admin\AppData\Local\Temp\service_updated.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1340 -s 540
Network
Files
memory/1340-54-0x0000000000CF0000-0x0000000000CFC000-memory.dmp