Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 14:46
Behavioral task
behavioral1
Sample
bb34cd21ee206d7806389f91f61db2e7.exe
Resource
win7-20230220-en
General
-
Target
bb34cd21ee206d7806389f91f61db2e7.exe
-
Size
62KB
-
MD5
bb34cd21ee206d7806389f91f61db2e7
-
SHA1
e841de62327b9471bd03e4b119a2bb74c9386eaa
-
SHA256
8b4f1c71738de8922b87e5a9edc2c5268c4737db0843eac102d7d95b0058db6c
-
SHA512
ae0a359345c54489ac84f393186b48862d256c410e3dac89f1698c75c936109e00ff7d125cddd23f38a57378a48c5f14bef4fd2bc995edf4b04ffdddde88e5e9
-
SSDEEP
1536:Xv3TgTyogc90aJb9eVor7VcUYZR4v7qf+:XfTgTyogcOaJb99CUcxm
Malware Config
Extracted
asyncrat
true
YouTube C
RRAT_HSzLEG3X5
-
delay
3
-
install
false
-
install_file
powershell Add-MpPreference -ExclusionPath C:\
-
install_folder
Explorer.exe
-
pastebin_config
http://pastebin.com/raw/KKpnJShN
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3384-133-0x00000000004A0000-0x00000000004B6000-memory.dmp asyncrat C:\Users\Admin\Explorer.exe asyncrat C:\Users\Admin\Explorer.exe asyncrat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bb34cd21ee206d7806389f91f61db2e7.exeExplorer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation bb34cd21ee206d7806389f91f61db2e7.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation Explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
Explorer.exepid process 4980 Explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 5084 schtasks.exe 4372 schtasks.exe 1352 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3672 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
powershell.exebb34cd21ee206d7806389f91f61db2e7.exepid process 1432 powershell.exe 1432 powershell.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe 3384 bb34cd21ee206d7806389f91f61db2e7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exebb34cd21ee206d7806389f91f61db2e7.exeExplorer.exedescription pid process Token: SeDebugPrivilege 1432 powershell.exe Token: SeDebugPrivilege 3384 bb34cd21ee206d7806389f91f61db2e7.exe Token: SeDebugPrivilege 4980 Explorer.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
bb34cd21ee206d7806389f91f61db2e7.execmd.execmd.execmd.exeExplorer.execmd.execmd.exedescription pid process target process PID 3384 wrote to memory of 3052 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 3052 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 3052 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3052 wrote to memory of 1432 3052 cmd.exe powershell.exe PID 3052 wrote to memory of 1432 3052 cmd.exe powershell.exe PID 3052 wrote to memory of 1432 3052 cmd.exe powershell.exe PID 3384 wrote to memory of 4752 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 4752 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 4752 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 4232 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 4232 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 3384 wrote to memory of 4232 3384 bb34cd21ee206d7806389f91f61db2e7.exe cmd.exe PID 4752 wrote to memory of 5084 4752 cmd.exe schtasks.exe PID 4752 wrote to memory of 5084 4752 cmd.exe schtasks.exe PID 4752 wrote to memory of 5084 4752 cmd.exe schtasks.exe PID 4232 wrote to memory of 3672 4232 cmd.exe timeout.exe PID 4232 wrote to memory of 3672 4232 cmd.exe timeout.exe PID 4232 wrote to memory of 3672 4232 cmd.exe timeout.exe PID 4232 wrote to memory of 4980 4232 cmd.exe Explorer.exe PID 4232 wrote to memory of 4980 4232 cmd.exe Explorer.exe PID 4232 wrote to memory of 4980 4232 cmd.exe Explorer.exe PID 4980 wrote to memory of 3740 4980 Explorer.exe cmd.exe PID 4980 wrote to memory of 3740 4980 Explorer.exe cmd.exe PID 4980 wrote to memory of 3740 4980 Explorer.exe cmd.exe PID 4980 wrote to memory of 2164 4980 Explorer.exe cmd.exe PID 4980 wrote to memory of 2164 4980 Explorer.exe cmd.exe PID 4980 wrote to memory of 2164 4980 Explorer.exe cmd.exe PID 3740 wrote to memory of 4372 3740 cmd.exe schtasks.exe PID 3740 wrote to memory of 4372 3740 cmd.exe schtasks.exe PID 3740 wrote to memory of 4372 3740 cmd.exe schtasks.exe PID 2164 wrote to memory of 1352 2164 cmd.exe schtasks.exe PID 2164 wrote to memory of 1352 2164 cmd.exe schtasks.exe PID 2164 wrote to memory of 1352 2164 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb34cd21ee206d7806389f91f61db2e7.exe"C:\Users\Admin\AppData\Local\Temp\bb34cd21ee206d7806389f91f61db2e7.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\Admin\Explorer.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows\WindowsUpdater" /tr '"C:\Users\Admin\Explorer.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7563.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Explorer.exe"C:\Users\Admin\Explorer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\Admin\AppData\Local\explore.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdate" /tr "C:\Users\Admin\AppData\Local\explore.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Cschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONIDLE /i 1 /rl highest /tn "Windows\WinUpdaters" /tr "cmd.exe /C powershell Add-MpPreference -ExclusionPath C:\"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0cgegu2n.dzv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp7563.tmp.batFilesize
136B
MD5a2429cd8879ee0fb73ba01d74c9ccddc
SHA18e5c82b8cf62fe8c8c604d6e3508969310a15cb8
SHA256b069be92bf03b9765edd95234c98adf3d78997a24fb3549b9518b821cd2d1010
SHA512fd56902495a5d95647f7f393f914ecf7f6510f58e50a591ca99312d9d3e40ab879e97a86753972bdf6bfbf211fae455bc666017967fcdf3605d978228006da8a
-
C:\Users\Admin\Explorer.exeFilesize
62KB
MD5bb34cd21ee206d7806389f91f61db2e7
SHA1e841de62327b9471bd03e4b119a2bb74c9386eaa
SHA2568b4f1c71738de8922b87e5a9edc2c5268c4737db0843eac102d7d95b0058db6c
SHA512ae0a359345c54489ac84f393186b48862d256c410e3dac89f1698c75c936109e00ff7d125cddd23f38a57378a48c5f14bef4fd2bc995edf4b04ffdddde88e5e9
-
C:\Users\Admin\Explorer.exeFilesize
62KB
MD5bb34cd21ee206d7806389f91f61db2e7
SHA1e841de62327b9471bd03e4b119a2bb74c9386eaa
SHA2568b4f1c71738de8922b87e5a9edc2c5268c4737db0843eac102d7d95b0058db6c
SHA512ae0a359345c54489ac84f393186b48862d256c410e3dac89f1698c75c936109e00ff7d125cddd23f38a57378a48c5f14bef4fd2bc995edf4b04ffdddde88e5e9
-
memory/1432-159-0x0000000070620000-0x000000007066C000-memory.dmpFilesize
304KB
-
memory/1432-158-0x0000000006690000-0x00000000066C2000-memory.dmpFilesize
200KB
-
memory/1432-139-0x0000000005220000-0x0000000005242000-memory.dmpFilesize
136KB
-
memory/1432-137-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/1432-140-0x00000000059F0000-0x0000000005A56000-memory.dmpFilesize
408KB
-
memory/1432-146-0x0000000005AD0000-0x0000000005B36000-memory.dmpFilesize
408KB
-
memory/1432-151-0x00000000060C0000-0x00000000060DE000-memory.dmpFilesize
120KB
-
memory/1432-138-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/1432-136-0x0000000005290000-0x00000000058B8000-memory.dmpFilesize
6.2MB
-
memory/1432-180-0x0000000007600000-0x000000000760E000-memory.dmpFilesize
56KB
-
memory/1432-182-0x00000000076F0000-0x00000000076F8000-memory.dmpFilesize
32KB
-
memory/1432-169-0x0000000006600000-0x000000000661E000-memory.dmpFilesize
120KB
-
memory/1432-170-0x000000007F1B0000-0x000000007F1C0000-memory.dmpFilesize
64KB
-
memory/1432-171-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/1432-172-0x0000000007A10000-0x000000000808A000-memory.dmpFilesize
6.5MB
-
memory/1432-173-0x00000000073D0000-0x00000000073EA000-memory.dmpFilesize
104KB
-
memory/1432-174-0x0000000007440000-0x000000000744A000-memory.dmpFilesize
40KB
-
memory/1432-175-0x0000000007650000-0x00000000076E6000-memory.dmpFilesize
600KB
-
memory/1432-135-0x00000000027D0000-0x0000000002806000-memory.dmpFilesize
216KB
-
memory/1432-181-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/3384-152-0x0000000005B50000-0x0000000005BEC000-memory.dmpFilesize
624KB
-
memory/3384-134-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/3384-133-0x00000000004A0000-0x00000000004B6000-memory.dmpFilesize
88KB
-
memory/4980-179-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/4980-186-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB