Analysis
-
max time kernel
150s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 13:26
Behavioral task
behavioral1
Sample
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
Resource
win7-20230220-en
General
-
Target
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
-
Size
309KB
-
MD5
66b5dabec55deb65ac6ecdbb385c9181
-
SHA1
8485dc1ecf501916e3850521e81112fccdfaa110
-
SHA256
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
-
SHA512
28ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
SSDEEP
3072:WHuQETR+J2IoYcOXb/CPJDjSIU1dA+h9b3dA2/S1dAK3dA/Sf6CwCPuikC0oXz2T:ouQ1MIPXXbaQIDp5OqfO
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1177
jntrojan.ddns.net:6606
jntrojan.ddns.net:7707
jntrojan.ddns.net:8808
jntrojan.ddns.net:1177
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
windows.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 6 IoCs
resource yara_rule behavioral1/memory/1100-54-0x0000000000FD0000-0x0000000001024000-memory.dmp asyncrat behavioral1/files/0x00090000000130e0-65.dat asyncrat behavioral1/files/0x00090000000130e0-66.dat asyncrat behavioral1/files/0x00090000000130e0-67.dat asyncrat behavioral1/memory/656-68-0x0000000001020000-0x0000000001074000-memory.dmp asyncrat behavioral1/memory/656-70-0x0000000004C70000-0x0000000004CB0000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 656 windows.exe -
Loads dropped DLL 1 IoCs
pid Process 1380 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 756 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 364 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe Token: SeDebugPrivilege 656 windows.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1912 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 26 PID 1100 wrote to memory of 1912 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 26 PID 1100 wrote to memory of 1912 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 26 PID 1100 wrote to memory of 1912 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 26 PID 1100 wrote to memory of 1380 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 29 PID 1100 wrote to memory of 1380 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 29 PID 1100 wrote to memory of 1380 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 29 PID 1100 wrote to memory of 1380 1100 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 29 PID 1912 wrote to memory of 756 1912 cmd.exe 30 PID 1912 wrote to memory of 756 1912 cmd.exe 30 PID 1912 wrote to memory of 756 1912 cmd.exe 30 PID 1912 wrote to memory of 756 1912 cmd.exe 30 PID 1380 wrote to memory of 364 1380 cmd.exe 31 PID 1380 wrote to memory of 364 1380 cmd.exe 31 PID 1380 wrote to memory of 364 1380 cmd.exe 31 PID 1380 wrote to memory of 364 1380 cmd.exe 31 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32 PID 1380 wrote to memory of 656 1380 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"'3⤵
- Creates scheduled task(s)
PID:756
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC09.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:364
-
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD552c5bdab455c24867afc562414483c94
SHA1155cd1a9be6ce083a931023c99064aa6cc6108ae
SHA2568c3dfd27011ce456c989a1f8ebcb023db449af013a6e3b894fc7c5ba8b003494
SHA512388dab6a3db1793909c4d6821f95c26f0a36f72e4d9e227b424d7e15abc7fc874f5c1cc5eed92dbcc27433444defbdd3799a1cc6f69fbd69a2973b3f8ab062db
-
Filesize
154B
MD552c5bdab455c24867afc562414483c94
SHA1155cd1a9be6ce083a931023c99064aa6cc6108ae
SHA2568c3dfd27011ce456c989a1f8ebcb023db449af013a6e3b894fc7c5ba8b003494
SHA512388dab6a3db1793909c4d6821f95c26f0a36f72e4d9e227b424d7e15abc7fc874f5c1cc5eed92dbcc27433444defbdd3799a1cc6f69fbd69a2973b3f8ab062db
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8