Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 14:31
Behavioral task
behavioral1
Sample
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
Resource
win7-20230220-en
General
-
Target
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
-
Size
309KB
-
MD5
66b5dabec55deb65ac6ecdbb385c9181
-
SHA1
8485dc1ecf501916e3850521e81112fccdfaa110
-
SHA256
9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
-
SHA512
28ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
SSDEEP
3072:WHuQETR+J2IoYcOXb/CPJDjSIU1dA+h9b3dA2/S1dAK3dA/Sf6CwCPuikC0oXz2T:ouQ1MIPXXbaQIDp5OqfO
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1177
jntrojan.ddns.net:6606
jntrojan.ddns.net:7707
jntrojan.ddns.net:8808
jntrojan.ddns.net:1177
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
windows.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/3472-133-0x00000000008F0000-0x0000000000944000-memory.dmp asyncrat behavioral2/files/0x000900000002314b-143.dat asyncrat behavioral2/files/0x000900000002314b-144.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe -
Executes dropped EXE 1 IoCs
pid Process 4956 windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4780 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4832 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe Token: SeDebugPrivilege 4956 windows.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3472 wrote to memory of 936 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 86 PID 3472 wrote to memory of 936 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 86 PID 3472 wrote to memory of 936 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 86 PID 3472 wrote to memory of 3636 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 88 PID 3472 wrote to memory of 3636 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 88 PID 3472 wrote to memory of 3636 3472 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe 88 PID 3636 wrote to memory of 4832 3636 cmd.exe 91 PID 3636 wrote to memory of 4832 3636 cmd.exe 91 PID 3636 wrote to memory of 4832 3636 cmd.exe 91 PID 936 wrote to memory of 4780 936 cmd.exe 90 PID 936 wrote to memory of 4780 936 cmd.exe 90 PID 936 wrote to memory of 4780 936 cmd.exe 90 PID 3636 wrote to memory of 4956 3636 cmd.exe 92 PID 3636 wrote to memory of 4956 3636 cmd.exe 92 PID 3636 wrote to memory of 4956 3636 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"C:\Users\Admin\AppData\Local\Temp\9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows" /tr '"C:\Users\Admin\AppData\Local\Temp\windows.exe"'3⤵
- Creates scheduled task(s)
PID:4780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCF0D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD5cf040bb5d517261895df2158073d1186
SHA129f571645efcf8c0d9a6aeb4003be155e14fbbf0
SHA2562d340771ba16433d9dffeb26d3aab4202a20938f787adcc4fd3d2aac09ddf58e
SHA512a4591a6c3e99a98411601f98d55fd8edd2225341837b488f8b96cc914fd5dd7e0e0ba3747740a2eb93c7b65eabfb0607dce4e788cae6ae22f3aba63d1f111327
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8
-
Filesize
309KB
MD566b5dabec55deb65ac6ecdbb385c9181
SHA18485dc1ecf501916e3850521e81112fccdfaa110
SHA2569a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138
SHA51228ff7068f0d8c1d7e0de8a6129d64db7d566868dc93e9bb8ba4de737d11483f8dd52edc6f67799cdf3396109061835bce472a2123477bb9304f1ff902ffdffb8