Analysis
-
max time kernel
39s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 21:21
Behavioral task
behavioral1
Sample
9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe
Resource
win7-20230220-en
General
-
Target
9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe
-
Size
47KB
-
MD5
3693114744003b6641e3c767518e47da
-
SHA1
22df3884394cedffe035dfd1e73d2969468ec793
-
SHA256
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
-
SHA512
eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
SSDEEP
768:0oFKMJMj5I4G3y/NlIR2qeYhQjCY7jbzgr3irE5a4g1fVMjrClZZ2tYcFmVc6K:0oFKMJezqzhMvbsrSX38urZKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla11.publicvm.com:6606
milla11.publicvm.com:7707
milla11.publicvm.com:8808
trffisyuiifgqcpeof
-
delay
5
-
install
true
-
install_file
explorere.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-54-0x0000000000F60000-0x0000000000F72000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat behavioral1/memory/1700-70-0x0000000001370000-0x0000000001382000-memory.dmp asyncrat behavioral1/memory/1700-71-0x0000000000A40000-0x0000000000AC0000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
explorere.exepid process 1700 explorere.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1672 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exepid process 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exeexplorere.exedescription pid process Token: SeDebugPrivilege 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe Token: SeDebugPrivilege 1700 explorere.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.execmd.execmd.exedescription pid process target process PID 1244 wrote to memory of 1436 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 1244 wrote to memory of 1436 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 1244 wrote to memory of 1436 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 1436 wrote to memory of 1792 1436 cmd.exe schtasks.exe PID 1436 wrote to memory of 1792 1436 cmd.exe schtasks.exe PID 1436 wrote to memory of 1792 1436 cmd.exe schtasks.exe PID 1244 wrote to memory of 768 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 1244 wrote to memory of 768 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 1244 wrote to memory of 768 1244 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe cmd.exe PID 768 wrote to memory of 1672 768 cmd.exe timeout.exe PID 768 wrote to memory of 1672 768 cmd.exe timeout.exe PID 768 wrote to memory of 1672 768 cmd.exe timeout.exe PID 768 wrote to memory of 1700 768 cmd.exe explorere.exe PID 768 wrote to memory of 1700 768 cmd.exe explorere.exe PID 768 wrote to memory of 1700 768 cmd.exe explorere.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe"C:\Users\Admin\AppData\Local\Temp\9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp694F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorere.exe"C:\Users\Admin\AppData\Roaming\explorere.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp694F.tmp.batFilesize
153B
MD544aece25e0fb1d6f5a717946b5b6948c
SHA19f8fcb64eac6857459fb752b9cfec1496b589a3f
SHA256046e61521c86b6bfdb3e3cb541afc6da9698bbe85e0196ded47547225a23c59f
SHA512be071efd1f316b11a9e4567c84ce265e955144a4052e2d37be7419413d844eed096a50e7d7e225061359edb21a03e1c28ed13c19447e26e60f8d99c6174e9ae0
-
C:\Users\Admin\AppData\Local\Temp\tmp694F.tmp.batFilesize
153B
MD544aece25e0fb1d6f5a717946b5b6948c
SHA19f8fcb64eac6857459fb752b9cfec1496b589a3f
SHA256046e61521c86b6bfdb3e3cb541afc6da9698bbe85e0196ded47547225a23c59f
SHA512be071efd1f316b11a9e4567c84ce265e955144a4052e2d37be7419413d844eed096a50e7d7e225061359edb21a03e1c28ed13c19447e26e60f8d99c6174e9ae0
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD53693114744003b6641e3c767518e47da
SHA122df3884394cedffe035dfd1e73d2969468ec793
SHA2569bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
SHA512eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD53693114744003b6641e3c767518e47da
SHA122df3884394cedffe035dfd1e73d2969468ec793
SHA2569bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
SHA512eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
memory/1244-54-0x0000000000F60000-0x0000000000F72000-memory.dmpFilesize
72KB
-
memory/1244-57-0x000000001B2C0000-0x000000001B340000-memory.dmpFilesize
512KB
-
memory/1700-70-0x0000000001370000-0x0000000001382000-memory.dmpFilesize
72KB
-
memory/1700-71-0x0000000000A40000-0x0000000000AC0000-memory.dmpFilesize
512KB
-
memory/1700-89-0x0000000000A40000-0x0000000000AC0000-memory.dmpFilesize
512KB