Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 02:44
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win7-20230220-en
General
-
Target
Launcher.exe
-
Size
309KB
-
MD5
66b5dabec55deb65ac6ecdbb385c9181
-
SHA1
8485dc1ecf501916e3850521e81112fccdfaa110
-
SHA256
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
-
SHA512
28ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
SSDEEP
3072:WHuQETR+J2IoYcOXb/CPJDjSIU1dA+h9b3dA2/S1dAK3dA/Sf6CwCPuikC0oXz2T:ouQ1MIPXXbaQIDp5OqfO
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1177
jntrojan.ddns.net:6606
jntrojan.ddns.net:7707
jntrojan.ddns.net:8808
jntrojan.ddns.net:1177
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
windows.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/736-133-0x00000000003E0000-0x0000000000434000-memory.dmp asyncrat behavioral2/files/0x000a0000000230dd-142.dat asyncrat behavioral2/files/0x000a0000000230dd-143.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation Launcher.exe -
Executes dropped EXE 1 IoCs
pid Process 4808 windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3500 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 536 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe 736 Launcher.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 736 Launcher.exe Token: SeDebugPrivilege 4808 windows.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 736 wrote to memory of 5024 736 Launcher.exe 90 PID 736 wrote to memory of 5024 736 Launcher.exe 90 PID 736 wrote to memory of 5024 736 Launcher.exe 90 PID 736 wrote to memory of 4816 736 Launcher.exe 92 PID 736 wrote to memory of 4816 736 Launcher.exe 92 PID 736 wrote to memory of 4816 736 Launcher.exe 92 PID 5024 wrote to memory of 3500 5024 cmd.exe 94 PID 5024 wrote to memory of 3500 5024 cmd.exe 94 PID 5024 wrote to memory of 3500 5024 cmd.exe 94 PID 4816 wrote to memory of 536 4816 cmd.exe 95 PID 4816 wrote to memory of 536 4816 cmd.exe 95 PID 4816 wrote to memory of 536 4816 cmd.exe 95 PID 4816 wrote to memory of 4808 4816 cmd.exe 97 PID 4816 wrote to memory of 4808 4816 cmd.exe 97 PID 4816 wrote to memory of 4808 4816 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"'3⤵
- Creates scheduled task(s)
PID:3500
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp86C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:536
-
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5551e098f5dba2ba686203fac0074e6b4
SHA15cdf20379cb8d89f4df0944e50e97366f1028aba
SHA25616fe3142685d48f78ba19f57a4424bfc7f755754e4d094e2c15a8d27f7edbec0
SHA512741a7765993244ed8a4f58a248c5f9b73dfa4f243e9b323d479dc3d35808c9acea066b2f233e1bbda4f29289d1b8ba9bd3612339763fe7963f891bf1060914c8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8