Analysis
-
max time kernel
146s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 14:31
Behavioral task
behavioral1
Sample
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
Resource
win7-20230220-en
General
-
Target
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
-
Size
309KB
-
MD5
66b5dabec55deb65ac6ecdbb385c9181
-
SHA1
8485dc1ecf501916e3850521e81112fccdfaa110
-
SHA256
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
-
SHA512
28ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
SSDEEP
3072:WHuQETR+J2IoYcOXb/CPJDjSIU1dA+h9b3dA2/S1dAK3dA/Sf6CwCPuikC0oXz2T:ouQ1MIPXXbaQIDp5OqfO
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1177
jntrojan.ddns.net:6606
jntrojan.ddns.net:7707
jntrojan.ddns.net:8808
jntrojan.ddns.net:1177
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
windows.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1760-54-0x0000000001190000-0x00000000011E4000-memory.dmp asyncrat behavioral1/files/0x000a0000000122f9-65.dat asyncrat behavioral1/files/0x000a0000000122f9-66.dat asyncrat behavioral1/files/0x000a0000000122f9-67.dat asyncrat behavioral1/memory/1920-68-0x0000000001130000-0x0000000001184000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1920 windows.exe -
Loads dropped DLL 1 IoCs
pid Process 588 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1392 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 332 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe Token: SeDebugPrivilege 1920 windows.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1760 wrote to memory of 920 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 28 PID 1760 wrote to memory of 920 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 28 PID 1760 wrote to memory of 920 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 28 PID 1760 wrote to memory of 920 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 28 PID 1760 wrote to memory of 588 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 30 PID 1760 wrote to memory of 588 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 30 PID 1760 wrote to memory of 588 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 30 PID 1760 wrote to memory of 588 1760 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 30 PID 920 wrote to memory of 1392 920 cmd.exe 32 PID 920 wrote to memory of 1392 920 cmd.exe 32 PID 920 wrote to memory of 1392 920 cmd.exe 32 PID 920 wrote to memory of 1392 920 cmd.exe 32 PID 588 wrote to memory of 332 588 cmd.exe 33 PID 588 wrote to memory of 332 588 cmd.exe 33 PID 588 wrote to memory of 332 588 cmd.exe 33 PID 588 wrote to memory of 332 588 cmd.exe 33 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34 PID 588 wrote to memory of 1920 588 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"'3⤵
- Creates scheduled task(s)
PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2897.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD5e8f52cec60c6a7a1325e955624099193
SHA1386f4778e674427fe9de89759eb3f5bcc21947f6
SHA256689e27e3f714280de322bd5585f81a7d50000c0f486baca154eacfd4f0aa8820
SHA5129beaac2f5c93524b82894fe7861358281ff4f4d5ac4cf69de32730d277ab819827fb588d66f8b884d4a7fff93b662ba098b67fb039d7381a7bdfec7114565c5b
-
Filesize
154B
MD5e8f52cec60c6a7a1325e955624099193
SHA1386f4778e674427fe9de89759eb3f5bcc21947f6
SHA256689e27e3f714280de322bd5585f81a7d50000c0f486baca154eacfd4f0aa8820
SHA5129beaac2f5c93524b82894fe7861358281ff4f4d5ac4cf69de32730d277ab819827fb588d66f8b884d4a7fff93b662ba098b67fb039d7381a7bdfec7114565c5b
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8