Analysis
-
max time kernel
81s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 12:51
Behavioral task
behavioral1
Sample
a92bef216bec5b6fcc6a958305f81391.exe
Resource
win7-20230220-en
General
-
Target
a92bef216bec5b6fcc6a958305f81391.exe
-
Size
127KB
-
MD5
a92bef216bec5b6fcc6a958305f81391
-
SHA1
196de00aba5b37c7d7d5b7da6b6eb302257a81a9
-
SHA256
7b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
-
SHA512
1ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
SSDEEP
3072:lh0ZVtDuop7hxJB0S4rObd4r9MrUEkmnnnnnZ/iUvVfG:lh0HtDTpkrObaBM7nnnnngAO
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/YgX9vKea
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1608-133-0x0000000000B00000-0x0000000000B26000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a92bef216bec5b6fcc6a958305f81391.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation a92bef216bec5b6fcc6a958305f81391.exe -
Executes dropped EXE 1 IoCs
Processes:
ContainerRuntime.exepid process 4272 ContainerRuntime.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 832 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exepid process 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 1608 a92bef216bec5b6fcc6a958305f81391.exe 4272 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 1608 a92bef216bec5b6fcc6a958305f81391.exe Token: SeDebugPrivilege 4272 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 4272 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a92bef216bec5b6fcc6a958305f81391.execmd.execmd.exedescription pid process target process PID 1608 wrote to memory of 5072 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 1608 wrote to memory of 5072 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 1608 wrote to memory of 5072 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 1608 wrote to memory of 1268 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 1608 wrote to memory of 1268 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 1608 wrote to memory of 1268 1608 a92bef216bec5b6fcc6a958305f81391.exe cmd.exe PID 5072 wrote to memory of 2276 5072 cmd.exe schtasks.exe PID 5072 wrote to memory of 2276 5072 cmd.exe schtasks.exe PID 5072 wrote to memory of 2276 5072 cmd.exe schtasks.exe PID 1268 wrote to memory of 832 1268 cmd.exe timeout.exe PID 1268 wrote to memory of 832 1268 cmd.exe timeout.exe PID 1268 wrote to memory of 832 1268 cmd.exe timeout.exe PID 1268 wrote to memory of 4272 1268 cmd.exe ContainerRuntime.exe PID 1268 wrote to memory of 4272 1268 cmd.exe ContainerRuntime.exe PID 1268 wrote to memory of 4272 1268 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"C:\Users\Admin\AppData\Local\Temp\a92bef216bec5b6fcc6a958305f81391.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D05.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7D05.tmp.batFilesize
160B
MD577f12b35eb1873afe64ad79dcaed354c
SHA17f6fa05b2e1bc7945b38751b16adaba271fa093f
SHA256e23fc9917f0824d1ce9f63360e26c905c9fa0aa01dfa891e7a33428ed7fb5238
SHA51270dac307105e526b1b95c20fbe5d31af09e06cf86954316fe78eb12c0a09d9903c7cac1374f20309b9e0f7afb44e549aa5ebe1be711072b59faf11ab6be17724
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
127KB
MD5a92bef216bec5b6fcc6a958305f81391
SHA1196de00aba5b37c7d7d5b7da6b6eb302257a81a9
SHA2567b9a9b11fc9794d4e31d647a3cab02fecdb048e81bc13d37d1c3533b8e96a8d3
SHA5121ddd77de29270944f9c25769b1dd0d655abea9ea7619af560a9160ef6648a09c559348236c65919a3ec63ab5a1b97e51a20fd2fe05a716ca52de2cd510e9f3a6
-
memory/1608-133-0x0000000000B00000-0x0000000000B26000-memory.dmpFilesize
152KB
-
memory/1608-134-0x0000000002F00000-0x0000000002F10000-memory.dmpFilesize
64KB
-
memory/1608-135-0x0000000005660000-0x00000000056FC000-memory.dmpFilesize
624KB
-
memory/4272-144-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB
-
memory/4272-145-0x00000000060F0000-0x0000000006694000-memory.dmpFilesize
5.6MB
-
memory/4272-146-0x0000000005CE0000-0x0000000005D72000-memory.dmpFilesize
584KB
-
memory/4272-147-0x0000000006960000-0x000000000696A000-memory.dmpFilesize
40KB
-
memory/4272-148-0x0000000006C80000-0x0000000006CE6000-memory.dmpFilesize
408KB
-
memory/4272-149-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB