Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 01:46
Behavioral task
behavioral1
Sample
shadow.exe
Resource
win7-20230220-en
General
-
Target
shadow.exe
-
Size
45KB
-
MD5
b0c54754039e4c312c81cc1de388e1e6
-
SHA1
c00e8d078f1224156e5f34720732891afe72d654
-
SHA256
aa199fbb289e048c5abaa334be3eb172175cf53e736d3a15ca32549086c99a8c
-
SHA512
c58117d3f377b6b7c1bba94d56049927a2a0e76e4243fa217ed8af1e80365939a5d3441572dea3c079403c07cad36ffebd35703e69fb258518244f2ca25d8bc8
-
SSDEEP
768:DuU2VTwkbBHWU7TZcFmo2qjLKjGKG6PIyzjbFgX3i0ZHPcZekvlaBDZDx:DuU2VTwAJM2aKYDy3bCXS0ZC+dDx
Malware Config
Extracted
asyncrat
0.5.7B
Default
klept0wiz-33913.portmap.host:33913
guaeiofj398ajgka340gka9wk3f09jq3ad
-
delay
3
-
install
true
-
install_file
Management.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4768-133-0x0000000000510000-0x0000000000522000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Management.exe asyncrat C:\Users\Admin\AppData\Roaming\Management.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
shadow.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation shadow.exe -
Executes dropped EXE 1 IoCs
Processes:
Management.exepid process 3336 Management.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1340 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
shadow.exepid process 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe 4768 shadow.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shadow.exeManagement.exedescription pid process Token: SeDebugPrivilege 4768 shadow.exe Token: SeDebugPrivilege 3336 Management.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
shadow.execmd.execmd.exedescription pid process target process PID 4768 wrote to memory of 1788 4768 shadow.exe cmd.exe PID 4768 wrote to memory of 1788 4768 shadow.exe cmd.exe PID 4768 wrote to memory of 1788 4768 shadow.exe cmd.exe PID 4768 wrote to memory of 2296 4768 shadow.exe cmd.exe PID 4768 wrote to memory of 2296 4768 shadow.exe cmd.exe PID 4768 wrote to memory of 2296 4768 shadow.exe cmd.exe PID 2296 wrote to memory of 1340 2296 cmd.exe timeout.exe PID 2296 wrote to memory of 1340 2296 cmd.exe timeout.exe PID 2296 wrote to memory of 1340 2296 cmd.exe timeout.exe PID 1788 wrote to memory of 1156 1788 cmd.exe schtasks.exe PID 1788 wrote to memory of 1156 1788 cmd.exe schtasks.exe PID 1788 wrote to memory of 1156 1788 cmd.exe schtasks.exe PID 2296 wrote to memory of 3336 2296 cmd.exe Management.exe PID 2296 wrote to memory of 3336 2296 cmd.exe Management.exe PID 2296 wrote to memory of 3336 2296 cmd.exe Management.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shadow.exe"C:\Users\Admin\AppData\Local\Temp\shadow.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Management" /tr '"C:\Users\Admin\AppData\Roaming\Management.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Management" /tr '"C:\Users\Admin\AppData\Roaming\Management.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA146.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Management.exe"C:\Users\Admin\AppData\Roaming\Management.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA146.tmp.batFilesize
154B
MD52f9abb55f79f346255855184c4f7834f
SHA11641bbfef9ff836325b7ba07743211abb7905907
SHA25679bfb63029e507c754848633396bea242f46af94ebf93920ca9d6e25c7fa0d11
SHA5121b9eb9ebbf61f233c699387e8b9fab81d77f9f103272d7522a43b314dfba2164e27b87640ce5acb4b1bf29f0db0453abd8a7fc2a889bcd279ecad2beca7d3d0a
-
C:\Users\Admin\AppData\Roaming\Management.exeFilesize
45KB
MD5b0c54754039e4c312c81cc1de388e1e6
SHA1c00e8d078f1224156e5f34720732891afe72d654
SHA256aa199fbb289e048c5abaa334be3eb172175cf53e736d3a15ca32549086c99a8c
SHA512c58117d3f377b6b7c1bba94d56049927a2a0e76e4243fa217ed8af1e80365939a5d3441572dea3c079403c07cad36ffebd35703e69fb258518244f2ca25d8bc8
-
C:\Users\Admin\AppData\Roaming\Management.exeFilesize
45KB
MD5b0c54754039e4c312c81cc1de388e1e6
SHA1c00e8d078f1224156e5f34720732891afe72d654
SHA256aa199fbb289e048c5abaa334be3eb172175cf53e736d3a15ca32549086c99a8c
SHA512c58117d3f377b6b7c1bba94d56049927a2a0e76e4243fa217ed8af1e80365939a5d3441572dea3c079403c07cad36ffebd35703e69fb258518244f2ca25d8bc8
-
memory/3336-144-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/3336-145-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/4768-133-0x0000000000510000-0x0000000000522000-memory.dmpFilesize
72KB
-
memory/4768-134-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/4768-135-0x00000000050A0000-0x000000000513C000-memory.dmpFilesize
624KB