Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/03/2023, 15:27
Behavioral task
behavioral1
Sample
0x000300000002287f-434.exe
Resource
win7-20230220-en
General
-
Target
0x000300000002287f-434.exe
-
Size
63KB
-
MD5
2d7e104a199600d550879e132d877ee7
-
SHA1
9a702148bcb48c8f666d275b0b08bf2b1711e069
-
SHA256
4f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
-
SHA512
c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33
-
SSDEEP
768:a3lDmSRCvHxiP7VIiz9JS8cwoLw9Qq2R1+KASmv7mqb2nFpwH1ovTGU6eLMnqGzl:acHWRbc78du1ibb2w+3bdGztpqKmY7
Malware Config
Extracted
asyncrat
CYB3R R4T 1.0.7
Default
ii-usd.at.ply.gg:25036
Cyb3r_R4tMutex_Cyb3rw4rrior1011
-
delay
1
-
install
true
-
install_file
syscall.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1236-54-0x0000000001370000-0x0000000001386000-memory.dmp asyncrat behavioral1/files/0x000a0000000122fe-66.dat asyncrat behavioral1/files/0x000a0000000122fe-67.dat asyncrat behavioral1/memory/1280-68-0x0000000001360000-0x0000000001376000-memory.dmp asyncrat behavioral1/memory/1280-69-0x000000001A920000-0x000000001A9A0000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1280 syscall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1156 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1900 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1236 0x000300000002287f-434.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1236 0x000300000002287f-434.exe Token: SeDebugPrivilege 1280 syscall.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1236 wrote to memory of 876 1236 0x000300000002287f-434.exe 28 PID 1236 wrote to memory of 876 1236 0x000300000002287f-434.exe 28 PID 1236 wrote to memory of 876 1236 0x000300000002287f-434.exe 28 PID 1236 wrote to memory of 684 1236 0x000300000002287f-434.exe 30 PID 1236 wrote to memory of 684 1236 0x000300000002287f-434.exe 30 PID 1236 wrote to memory of 684 1236 0x000300000002287f-434.exe 30 PID 876 wrote to memory of 1156 876 cmd.exe 32 PID 876 wrote to memory of 1156 876 cmd.exe 32 PID 876 wrote to memory of 1156 876 cmd.exe 32 PID 684 wrote to memory of 1900 684 cmd.exe 33 PID 684 wrote to memory of 1900 684 cmd.exe 33 PID 684 wrote to memory of 1900 684 cmd.exe 33 PID 684 wrote to memory of 1280 684 cmd.exe 34 PID 684 wrote to memory of 1280 684 cmd.exe 34 PID 684 wrote to memory of 1280 684 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000300000002287f-434.exe"C:\Users\Admin\AppData\Local\Temp\0x000300000002287f-434.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "syscall" /tr '"C:\Users\Admin\AppData\Roaming\syscall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "syscall" /tr '"C:\Users\Admin\AppData\Roaming\syscall.exe"'3⤵
- Creates scheduled task(s)
PID:1156
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp19D8.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1900
-
-
C:\Users\Admin\AppData\Roaming\syscall.exe"C:\Users\Admin\AppData\Roaming\syscall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD5ca0b9c176f48414491de060a94c604a6
SHA18c7e229f28d3694db2cb311b25edc15fc0e81dab
SHA25646f72042397ac4749b3143ac1f648d1f9d7088f5bae9655f2e46d3f9cae62cea
SHA51218ffdd92fbfdc622278e4c3e34feee7a526d3605bb5378620d65d4ce9eb07ee9c78584da27f573e2093415c63cd9796e287795c3ce7e2c946b0890008952e12f
-
Filesize
151B
MD5ca0b9c176f48414491de060a94c604a6
SHA18c7e229f28d3694db2cb311b25edc15fc0e81dab
SHA25646f72042397ac4749b3143ac1f648d1f9d7088f5bae9655f2e46d3f9cae62cea
SHA51218ffdd92fbfdc622278e4c3e34feee7a526d3605bb5378620d65d4ce9eb07ee9c78584da27f573e2093415c63cd9796e287795c3ce7e2c946b0890008952e12f
-
Filesize
63KB
MD52d7e104a199600d550879e132d877ee7
SHA19a702148bcb48c8f666d275b0b08bf2b1711e069
SHA2564f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
SHA512c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33
-
Filesize
63KB
MD52d7e104a199600d550879e132d877ee7
SHA19a702148bcb48c8f666d275b0b08bf2b1711e069
SHA2564f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
SHA512c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33