Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
Odeme3222023.scr.exe
Resource
win7-20230220-en
General
-
Target
Odeme3222023.scr.exe
-
Size
635KB
-
MD5
02e24e9cfe0669ac85121b1b35f7a942
-
SHA1
0acb91424c9e6329b0966177cc5541f0bb2c4908
-
SHA256
7158cb26fb5a843496b92e30c4366fdfa2b49cd8c59f280ee71e853a68ef0a69
-
SHA512
cc697818469e535cdb3d9470bb25d38f8d845d668d50e72b61911bd561d94ffff5e04448fda4537bba28fb5666345b1fc748b1f80443c54bac6ca191df4de013
-
SSDEEP
12288:NcrNS33L10QdrXjCDn1R6WlM96zWDfJbZEvJmD7ugVkh/fwJ6DD:wNA3R5drX2D1RTM9aEfJbUYD79ofJDD
Malware Config
Extracted
asyncrat
0.5.7B
Mnock
mooroopecamroy.sytes.net:1452
mooroopecamroy.sytes.net:1432
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
crssi.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2296-162-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Odeme3222023.scr.exekopjlkjo.sfx.exekopjlkjo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation Odeme3222023.scr.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation kopjlkjo.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation kopjlkjo.exe -
Executes dropped EXE 5 IoCs
Processes:
kopjlkjo.sfx.exekopjlkjo.exekopjlkjo.execrssi.execrssi.exepid process 4080 kopjlkjo.sfx.exe 3160 kopjlkjo.exe 2296 kopjlkjo.exe 1152 crssi.exe 1028 crssi.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
kopjlkjo.execrssi.exedescription pid process target process PID 3160 set thread context of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 1152 set thread context of 1028 1152 crssi.exe crssi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4756 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
kopjlkjo.exepid process 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe 2296 kopjlkjo.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
kopjlkjo.exekopjlkjo.execrssi.execrssi.exedescription pid process Token: SeDebugPrivilege 3160 kopjlkjo.exe Token: SeDebugPrivilege 2296 kopjlkjo.exe Token: SeDebugPrivilege 1152 crssi.exe Token: SeDebugPrivilege 1028 crssi.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
Odeme3222023.scr.execmd.exekopjlkjo.sfx.exekopjlkjo.exekopjlkjo.execmd.execmd.execrssi.exedescription pid process target process PID 4964 wrote to memory of 4180 4964 Odeme3222023.scr.exe cmd.exe PID 4964 wrote to memory of 4180 4964 Odeme3222023.scr.exe cmd.exe PID 4964 wrote to memory of 4180 4964 Odeme3222023.scr.exe cmd.exe PID 4180 wrote to memory of 4080 4180 cmd.exe kopjlkjo.sfx.exe PID 4180 wrote to memory of 4080 4180 cmd.exe kopjlkjo.sfx.exe PID 4180 wrote to memory of 4080 4180 cmd.exe kopjlkjo.sfx.exe PID 4080 wrote to memory of 3160 4080 kopjlkjo.sfx.exe kopjlkjo.exe PID 4080 wrote to memory of 3160 4080 kopjlkjo.sfx.exe kopjlkjo.exe PID 4080 wrote to memory of 3160 4080 kopjlkjo.sfx.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 3160 wrote to memory of 2296 3160 kopjlkjo.exe kopjlkjo.exe PID 2296 wrote to memory of 3952 2296 kopjlkjo.exe cmd.exe PID 2296 wrote to memory of 3952 2296 kopjlkjo.exe cmd.exe PID 2296 wrote to memory of 3952 2296 kopjlkjo.exe cmd.exe PID 2296 wrote to memory of 2652 2296 kopjlkjo.exe cmd.exe PID 2296 wrote to memory of 2652 2296 kopjlkjo.exe cmd.exe PID 2296 wrote to memory of 2652 2296 kopjlkjo.exe cmd.exe PID 2652 wrote to memory of 4756 2652 cmd.exe timeout.exe PID 2652 wrote to memory of 4756 2652 cmd.exe timeout.exe PID 2652 wrote to memory of 4756 2652 cmd.exe timeout.exe PID 3952 wrote to memory of 1620 3952 cmd.exe schtasks.exe PID 3952 wrote to memory of 1620 3952 cmd.exe schtasks.exe PID 3952 wrote to memory of 1620 3952 cmd.exe schtasks.exe PID 2652 wrote to memory of 1152 2652 cmd.exe crssi.exe PID 2652 wrote to memory of 1152 2652 cmd.exe crssi.exe PID 2652 wrote to memory of 1152 2652 cmd.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe PID 1152 wrote to memory of 1028 1152 crssi.exe crssi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Odeme3222023.scr.exe"C:\Users\Admin\AppData\Local\Temp\Odeme3222023.scr.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iliychjo.cmd" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exekopjlkjo.sfx.exe -dC:\Users\Admin\AppData\Local\Temp -pmheutdbtrfcaszjnhjfehfegddeoqxapofdgyayhdqboofhafugBbshhddfdtgxdkqekecVohobthtigdge3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe"C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeC:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "crssi" /tr '"C:\Users\Admin\AppData\Roaming\crssi.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "crssi" /tr '"C:\Users\Admin\AppData\Roaming\crssi.exe"'7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1879.tmp.bat""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\crssi.exe"C:\Users\Admin\AppData\Roaming\crssi.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\crssi.exeC:\Users\Admin\AppData\Roaming\crssi.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\crssi.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kopjlkjo.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\iliychjo.cmdFilesize
10KB
MD55c6c1129a2ec722e4067d9fb09369799
SHA1afab2aeb341a719dad8b48f542f7fb966a38c30c
SHA256a9b935bb8953156779753ee2cd340e3e06428120c74003ac5a6570542e7f0f9f
SHA512e86c174b327cc8c2ab3a9b5ef68ae308468a1113b905c8f3d5d0b7f031b4166eef933e26a1796bc44deac02004cc15ee1e1cf0529ec814e6dc5e959e30df0c86
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exeFilesize
446KB
MD5a70ce8a186b33c8dbad85d8717f97574
SHA1c3b041e092a2816f7e969913e44a96646762d7a1
SHA25683b8efd5fd67b4f6afa96daccd6fac873f9d2f09dd6cfb50febbd2d0543f6a6b
SHA51276cf4426aaf7a9ac7be55c1276607b2abab37c85412b959a1437ef2d80de2ebd94ba6f1a134d5affb2ec6e78900afcd9d001072957b64314aadf34a2ff82e9fb
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exeFilesize
446KB
MD5a70ce8a186b33c8dbad85d8717f97574
SHA1c3b041e092a2816f7e969913e44a96646762d7a1
SHA25683b8efd5fd67b4f6afa96daccd6fac873f9d2f09dd6cfb50febbd2d0543f6a6b
SHA51276cf4426aaf7a9ac7be55c1276607b2abab37c85412b959a1437ef2d80de2ebd94ba6f1a134d5affb2ec6e78900afcd9d001072957b64314aadf34a2ff82e9fb
-
C:\Users\Admin\AppData\Local\Temp\tmp1879.tmp.batFilesize
149B
MD5b0f0b2722740adc87634e95dad1edb9d
SHA14e9a6ecd2f545553f27f0bbce77ffff1db0f3885
SHA2565615e6ab8bdfab5992ecf63657bf57dda4346e666f158963146067f5fa748c60
SHA512dbdfb723702b9b644dd9517a46a687823b1ad32fa20080326c0a64faae83d263f6fcfafee61a8ae2c5be065212736421a85a32fcb42ebbe535b0fe1523be9f28
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
memory/1028-180-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/1028-181-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/1152-175-0x00000000032D0000-0x00000000032E0000-memory.dmpFilesize
64KB
-
memory/2296-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2296-166-0x00000000051B0000-0x00000000051C0000-memory.dmpFilesize
64KB
-
memory/2296-167-0x00000000052C0000-0x0000000005326000-memory.dmpFilesize
408KB
-
memory/3160-161-0x000000000E380000-0x000000000E412000-memory.dmpFilesize
584KB
-
memory/3160-160-0x000000000E890000-0x000000000EE34000-memory.dmpFilesize
5.6MB
-
memory/3160-159-0x000000000E240000-0x000000000E2DC000-memory.dmpFilesize
624KB
-
memory/3160-158-0x0000000005830000-0x0000000005840000-memory.dmpFilesize
64KB
-
memory/3160-157-0x0000000000C50000-0x0000000000C8E000-memory.dmpFilesize
248KB