Analysis
-
max time kernel
61s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 01:14
Behavioral task
behavioral1
Sample
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe
Resource
win7-20230220-en
General
-
Target
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe
-
Size
47KB
-
MD5
3693114744003b6641e3c767518e47da
-
SHA1
22df3884394cedffe035dfd1e73d2969468ec793
-
SHA256
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
-
SHA512
eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
SSDEEP
768:0oFKMJMj5I4G3y/NlIR2qeYhQjCY7jbzgr3irE5a4g1fVMjrClZZ2tYcFmVc6K:0oFKMJezqzhMvbsrSX38urZKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla11.publicvm.com:6606
milla11.publicvm.com:7707
milla11.publicvm.com:8808
trffisyuiifgqcpeof
-
delay
5
-
install
true
-
install_file
explorere.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-133-0x0000000000D20000-0x0000000000D32000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat behavioral2/memory/4424-143-0x000000001B520000-0x000000001B530000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe -
Executes dropped EXE 1 IoCs
Processes:
explorere.exepid process 4424 explorere.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4944 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exepid process 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exeexplorere.exedescription pid process Token: SeDebugPrivilege 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe Token: SeDebugPrivilege 4424 explorere.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.execmd.execmd.exedescription pid process target process PID 2372 wrote to memory of 2780 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe cmd.exe PID 2372 wrote to memory of 2780 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe cmd.exe PID 2372 wrote to memory of 1624 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe cmd.exe PID 2372 wrote to memory of 1624 2372 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe cmd.exe PID 1624 wrote to memory of 4944 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 4944 1624 cmd.exe timeout.exe PID 2780 wrote to memory of 4404 2780 cmd.exe schtasks.exe PID 2780 wrote to memory of 4404 2780 cmd.exe schtasks.exe PID 1624 wrote to memory of 4424 1624 cmd.exe explorere.exe PID 1624 wrote to memory of 4424 1624 cmd.exe explorere.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe"C:\Users\Admin\AppData\Local\Temp\9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF486.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorere.exe"C:\Users\Admin\AppData\Roaming\explorere.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF486.tmp.batFilesize
153B
MD581d4e9dc53feb2788e5a4f1c0f3b39bc
SHA1eb7835e3653d37b271392341c62b1c2d5135a52a
SHA256874b9309e4e7ac0d9a258d92a52d99ee0965c2fc77e0a3986da7c2d6644d6ffe
SHA512c867716e86a660f482aea22ea9e37e21a8b9e6821f7b08dd03d3ebe9146ba905db63a3a3d759f73d66c1f94fb7a293af4e0bdc7c92c6b36dded7eb12b323d096
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD53693114744003b6641e3c767518e47da
SHA122df3884394cedffe035dfd1e73d2969468ec793
SHA2569bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
SHA512eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD53693114744003b6641e3c767518e47da
SHA122df3884394cedffe035dfd1e73d2969468ec793
SHA2569bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc
SHA512eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836
-
memory/2372-133-0x0000000000D20000-0x0000000000D32000-memory.dmpFilesize
72KB
-
memory/2372-134-0x000000001BAA0000-0x000000001BAB0000-memory.dmpFilesize
64KB
-
memory/4424-143-0x000000001B520000-0x000000001B530000-memory.dmpFilesize
64KB
-
memory/4424-144-0x000000001B520000-0x000000001B530000-memory.dmpFilesize
64KB