Analysis
-
max time kernel
31s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 12:51
Behavioral task
behavioral1
Sample
a92bef216bec5b6fcc6a958305f81391.exe
Resource
win7-20230220-en
General
-
Target
a92bef216bec5b6fcc6a958305f81391.exe
-
Size
127KB
-
MD5
a92bef216bec5b6fcc6a958305f81391
-
SHA1
196de00aba5b37c7d7d5b7da6b6eb302257a81a9
-
SHA256
7b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
-
SHA512
1ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
SSDEEP
3072:lh0ZVtDuop7hxJB0S4rObd4r9MrUEkmnnnnnZ/iUvVfG:lh0HtDTpkrObaBM7nnnnngAO
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/YgX9vKea
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/920-54-0x0000000000B40000-0x0000000000B66000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat behavioral1/memory/1332-68-0x0000000001030000-0x0000000001056000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
ContainerRuntime.exepid process 1332 ContainerRuntime.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 652 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exepid process 920 a92bef216bec5b6fcc6a958305f81391.exe 1332 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 920 a92bef216bec5b6fcc6a958305f81391.exe Token: SeDebugPrivilege 1332 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 1332 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.execmd.execmd.exedescription pid process target process PID 920 wrote to memory of 432 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 432 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 432 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 432 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 652 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 652 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 652 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 920 wrote to memory of 652 920 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 432 wrote to memory of 1972 432 cmd.exe schtasks.exe PID 432 wrote to memory of 1972 432 cmd.exe schtasks.exe PID 432 wrote to memory of 1972 432 cmd.exe schtasks.exe PID 432 wrote to memory of 1972 432 cmd.exe schtasks.exe PID 652 wrote to memory of 1640 652 cmd.exe timeout.exe PID 652 wrote to memory of 1640 652 cmd.exe timeout.exe PID 652 wrote to memory of 1640 652 cmd.exe timeout.exe PID 652 wrote to memory of 1640 652 cmd.exe timeout.exe PID 652 wrote to memory of 1332 652 cmd.exe ContainerRuntime.exe PID 652 wrote to memory of 1332 652 cmd.exe ContainerRuntime.exe PID 652 wrote to memory of 1332 652 cmd.exe ContainerRuntime.exe PID 652 wrote to memory of 1332 652 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp25F9.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp25F9.tmp.batFilesize
160B
MD59cbb4feda10d8b09c06b6cf31f302c8a
SHA1102edff29f8f2667e72ec8c7c2ceebd6bca853df
SHA2562a8f84ba9d24bae559c39818d2111ad61912f6ffd23c69d59e33c6c97ff4541a
SHA51275a08f8632410d0804904160a1df74bb25fe7773a9d8a2381525db8950a2bd38239181243ced15efec136b066604093d85f963a740e8547cdb715551e7f2373b
-
C:\Users\Admin\AppData\Local\Temp\tmp25F9.tmp.batFilesize
160B
MD59cbb4feda10d8b09c06b6cf31f302c8a
SHA1102edff29f8f2667e72ec8c7c2ceebd6bca853df
SHA2562a8f84ba9d24bae559c39818d2111ad61912f6ffd23c69d59e33c6c97ff4541a
SHA51275a08f8632410d0804904160a1df74bb25fe7773a9d8a2381525db8950a2bd38239181243ced15efec136b066604093d85f963a740e8547cdb715551e7f2373b
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
memory/920-54-0x0000000000B40000-0x0000000000B66000-memory.dmpFilesize
152KB
-
memory/920-55-0x0000000004970000-0x00000000049B0000-memory.dmpFilesize
256KB
-
memory/1332-68-0x0000000001030000-0x0000000001056000-memory.dmpFilesize
152KB