Analysis
-
max time kernel
70s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 03:00
Static task
static1
Behavioral task
behavioral1
Sample
Copy.exe
Resource
win7-20230220-en
General
-
Target
Copy.exe
-
Size
1.1MB
-
MD5
520ba96d18722d0d6dcc2f0250d52998
-
SHA1
b2db2f9fa0fd3a2c74ef0b10dc684737eac9f3d9
-
SHA256
ba4ffe8c2d64162b9f149242ecb7309a35886d05f5360da9e3e91a261a68c2ae
-
SHA512
44510d3088c495e49c0f3c71defaf7b244146424413a6432ed2f424b9f965b762683d497b697ab240eb10dead17de77c7abd1cd38727e92762ccae4aff444977
-
SSDEEP
24576:Ca+L5JM0ZZN8uX7QHUEjrgVo+ETCmqba0W+Tuu4gmmRt1ZGj:X+hjrX7Q0Ej4on23nTuu4gXR5G
Malware Config
Extracted
asyncrat
0.5.7B
Default
asyncgeneration1.duckdns.org:4404
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/912-75-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/912-76-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/912-78-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/912-80-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/912-82-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/524-83-0x0000000002270000-0x00000000022B0000-memory.dmp asyncrat behavioral1/memory/912-84-0x0000000002240000-0x0000000002280000-memory.dmp asyncrat behavioral1/memory/912-102-0x0000000002240000-0x0000000002280000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Copy.exedescription pid process target process PID 1444 set thread context of 912 1444 Copy.exe Copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Copy.exepowershell.exepowershell.exepid process 1444 Copy.exe 1444 Copy.exe 1444 Copy.exe 1672 powershell.exe 524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Copy.exepowershell.exepowershell.exeCopy.exedescription pid process Token: SeDebugPrivilege 1444 Copy.exe Token: SeDebugPrivilege 524 powershell.exe Token: SeDebugPrivilege 1672 powershell.exe Token: SeDebugPrivilege 912 Copy.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Copy.exedescription pid process target process PID 1444 wrote to memory of 524 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 524 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 524 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 524 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 1672 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 1672 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 1672 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 1672 1444 Copy.exe powershell.exe PID 1444 wrote to memory of 1992 1444 Copy.exe schtasks.exe PID 1444 wrote to memory of 1992 1444 Copy.exe schtasks.exe PID 1444 wrote to memory of 1992 1444 Copy.exe schtasks.exe PID 1444 wrote to memory of 1992 1444 Copy.exe schtasks.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe PID 1444 wrote to memory of 912 1444 Copy.exe Copy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Copy.exe"C:\Users\Admin\AppData\Local\Temp\Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Copy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yXBzlrEBvIU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yXBzlrEBvIU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFAF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Copy.exe"C:\Users\Admin\AppData\Local\Temp\Copy.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCFAF.tmpFilesize
1KB
MD57fce7d498c6456a237656ee1a41edad4
SHA11e65ccb00707a54fb363db0084d85491b8b3da91
SHA2563d3916e4b6dc6745369a1596555bfdc113601f81f9c57b7e0917bd45c96c34d6
SHA512161c22d60951181fec47d24bb1dbfb45d49e654494289cee6187b446fa49428d28017b629507b5e8d9cada43db392864e54e49da4d41e1807015213ff83e7b26
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Z4YLGSVIPC2OKGDHARE.tempFilesize
7KB
MD55d251d7bfe3901ffcb47c268b395aee7
SHA1fb522931226ce23865e7a10c7da2bf74723f1705
SHA2566009399dfcb7580eafc6c0c8f9564328104b2d48d65ebe3dd5c174962ed17867
SHA512e3c2eb89fefe6e79444ce14fa975b132f88d131af34ca27b70d465e54b2fa5fd20b0f24e24dc2e5a4d1ee725118a931465d49811e365b8f0192c475d24af1ab7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55d251d7bfe3901ffcb47c268b395aee7
SHA1fb522931226ce23865e7a10c7da2bf74723f1705
SHA2566009399dfcb7580eafc6c0c8f9564328104b2d48d65ebe3dd5c174962ed17867
SHA512e3c2eb89fefe6e79444ce14fa975b132f88d131af34ca27b70d465e54b2fa5fd20b0f24e24dc2e5a4d1ee725118a931465d49811e365b8f0192c475d24af1ab7
-
memory/524-83-0x0000000002270000-0x00000000022B0000-memory.dmpFilesize
256KB
-
memory/912-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-102-0x0000000002240000-0x0000000002280000-memory.dmpFilesize
256KB
-
memory/912-84-0x0000000002240000-0x0000000002280000-memory.dmpFilesize
256KB
-
memory/912-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/912-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1444-72-0x0000000000470000-0x00000000004DC000-memory.dmpFilesize
432KB
-
memory/1444-54-0x0000000000C40000-0x0000000000D64000-memory.dmpFilesize
1.1MB
-
memory/1444-56-0x0000000000560000-0x000000000057C000-memory.dmpFilesize
112KB
-
memory/1444-59-0x0000000007C50000-0x0000000007D34000-memory.dmpFilesize
912KB
-
memory/1444-55-0x00000000072B0000-0x00000000072F0000-memory.dmpFilesize
256KB
-
memory/1444-57-0x00000000072B0000-0x00000000072F0000-memory.dmpFilesize
256KB
-
memory/1444-58-0x0000000000510000-0x000000000051C000-memory.dmpFilesize
48KB