Analysis
-
max time kernel
149s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2023, 01:06
Behavioral task
behavioral1
Sample
25d7952b3e8c9f0872ecf4f099cea1a2.exe
Resource
win7-20230220-en
General
-
Target
25d7952b3e8c9f0872ecf4f099cea1a2.exe
-
Size
47KB
-
MD5
25d7952b3e8c9f0872ecf4f099cea1a2
-
SHA1
976e307d3fc015452e70acd29ebddef0d8823fac
-
SHA256
7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
-
SHA512
f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
SSDEEP
768:sJCO9ILoeck+riPUl5kJN/QisVF8YbWgTgDaJivEgK/JDqVc6KN:sJ588kqFzbJga4nkJDqVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
dom45x.duckdns.org:62180
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
resource yara_rule behavioral1/memory/1772-54-0x0000000001250000-0x0000000001262000-memory.dmp asyncrat behavioral1/files/0x000400000000b46e-66.dat asyncrat behavioral1/files/0x000400000000b46e-67.dat asyncrat behavioral1/memory/1528-68-0x0000000000CF0000-0x0000000000D02000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1528 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 696 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1300 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe Token: SeDebugPrivilege 1528 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1524 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 28 PID 1772 wrote to memory of 1524 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 28 PID 1772 wrote to memory of 1524 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 28 PID 1772 wrote to memory of 776 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 30 PID 1772 wrote to memory of 776 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 30 PID 1772 wrote to memory of 776 1772 25d7952b3e8c9f0872ecf4f099cea1a2.exe 30 PID 1524 wrote to memory of 696 1524 cmd.exe 32 PID 1524 wrote to memory of 696 1524 cmd.exe 32 PID 1524 wrote to memory of 696 1524 cmd.exe 32 PID 776 wrote to memory of 1300 776 cmd.exe 33 PID 776 wrote to memory of 1300 776 cmd.exe 33 PID 776 wrote to memory of 1300 776 cmd.exe 33 PID 776 wrote to memory of 1528 776 cmd.exe 34 PID 776 wrote to memory of 1528 776 cmd.exe 34 PID 776 wrote to memory of 1528 776 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d7952b3e8c9f0872ecf4f099cea1a2.exe"C:\Users\Admin\AppData\Local\Temp\25d7952b3e8c9f0872ecf4f099cea1a2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'3⤵
- Creates scheduled task(s)
PID:696
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1300
-
-
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD5180e332a9b854d3e85c7906df2f970b2
SHA1e5e3541088f64c160267cb7f64cd6cbab49b6de6
SHA2566b0d56e8dcb82a94a3ed6000b1b8564058c18c41618189b24eae68ac025a232f
SHA51271df612bb291a972babf0c4317c6bc8949e8fc27a401aed343fe571d13bc0a4c366e6eb503abe82c4b7446861247aa5ad2b91c49e394be8d1774db57b9cbfa9b
-
Filesize
156B
MD5180e332a9b854d3e85c7906df2f970b2
SHA1e5e3541088f64c160267cb7f64cd6cbab49b6de6
SHA2566b0d56e8dcb82a94a3ed6000b1b8564058c18c41618189b24eae68ac025a232f
SHA51271df612bb291a972babf0c4317c6bc8949e8fc27a401aed343fe571d13bc0a4c366e6eb503abe82c4b7446861247aa5ad2b91c49e394be8d1774db57b9cbfa9b
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb