Analysis
-
max time kernel
32s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 12:52
Behavioral task
behavioral1
Sample
a92bef216bec5b6fcc6a958305f81391.exe
Resource
win7-20230220-en
General
-
Target
a92bef216bec5b6fcc6a958305f81391.exe
-
Size
127KB
-
MD5
a92bef216bec5b6fcc6a958305f81391
-
SHA1
196de00aba5b37c7d7d5b7da6b6eb302257a81a9
-
SHA256
7b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
-
SHA512
1ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
SSDEEP
3072:lh0ZVtDuop7hxJB0S4rObd4r9MrUEkmnnnnnZ/iUvVfG:lh0HtDTpkrObaBM7nnnnngAO
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/YgX9vKea
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-54-0x0000000000010000-0x0000000000036000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat behavioral1/memory/1496-68-0x0000000001000000-0x0000000001026000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
ContainerRuntime.exepid process 1496 ContainerRuntime.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 340 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1724 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exepid process 2032 a92bef216bec5b6fcc6a958305f81391.exe 1496 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 2032 a92bef216bec5b6fcc6a958305f81391.exe Token: SeDebugPrivilege 1496 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 1496 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.execmd.execmd.exedescription pid process target process PID 2032 wrote to memory of 536 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 536 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 536 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 536 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 340 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 340 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 340 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 2032 wrote to memory of 340 2032 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 340 wrote to memory of 1724 340 cmd.exe timeout.exe PID 340 wrote to memory of 1724 340 cmd.exe timeout.exe PID 340 wrote to memory of 1724 340 cmd.exe timeout.exe PID 340 wrote to memory of 1724 340 cmd.exe timeout.exe PID 536 wrote to memory of 1768 536 cmd.exe schtasks.exe PID 536 wrote to memory of 1768 536 cmd.exe schtasks.exe PID 536 wrote to memory of 1768 536 cmd.exe schtasks.exe PID 536 wrote to memory of 1768 536 cmd.exe schtasks.exe PID 340 wrote to memory of 1496 340 cmd.exe ContainerRuntime.exe PID 340 wrote to memory of 1496 340 cmd.exe ContainerRuntime.exe PID 340 wrote to memory of 1496 340 cmd.exe ContainerRuntime.exe PID 340 wrote to memory of 1496 340 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5C35.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5C35.tmp.batFilesize
160B
MD5f5db9c9ab71181001d573a7b9bdc8abc
SHA17fa893a0f86d132c02378b86e990ac229eaa6849
SHA256f5d909eb6738b5dbf4edb0de881003017e8bc93ce44c718325da1b32242050da
SHA512032b8bcfbcf593f825d4c7c01ab96a809176688b9758fa3ed6444e682f69d17e51af0ef464a23be64a29a21d4e93864d880619c0a7565151d9d34510090237a1
-
C:\Users\Admin\AppData\Local\Temp\tmp5C35.tmp.batFilesize
160B
MD5f5db9c9ab71181001d573a7b9bdc8abc
SHA17fa893a0f86d132c02378b86e990ac229eaa6849
SHA256f5d909eb6738b5dbf4edb0de881003017e8bc93ce44c718325da1b32242050da
SHA512032b8bcfbcf593f825d4c7c01ab96a809176688b9758fa3ed6444e682f69d17e51af0ef464a23be64a29a21d4e93864d880619c0a7565151d9d34510090237a1
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
memory/1496-68-0x0000000001000000-0x0000000001026000-memory.dmpFilesize
152KB
-
memory/1496-69-0x0000000000ED0000-0x0000000000F10000-memory.dmpFilesize
256KB
-
memory/1496-87-0x0000000000ED0000-0x0000000000F10000-memory.dmpFilesize
256KB
-
memory/2032-54-0x0000000000010000-0x0000000000036000-memory.dmpFilesize
152KB
-
memory/2032-55-0x00000000048A0000-0x00000000048E0000-memory.dmpFilesize
256KB