Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2023, 01:06
Behavioral task
behavioral1
Sample
25d7952b3e8c9f0872ecf4f099cea1a2.exe
Resource
win7-20230220-en
General
-
Target
25d7952b3e8c9f0872ecf4f099cea1a2.exe
-
Size
47KB
-
MD5
25d7952b3e8c9f0872ecf4f099cea1a2
-
SHA1
976e307d3fc015452e70acd29ebddef0d8823fac
-
SHA256
7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
-
SHA512
f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
SSDEEP
768:sJCO9ILoeck+riPUl5kJN/QisVF8YbWgTgDaJivEgK/JDqVc6KN:sJ588kqFzbJga4nkJDqVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
dom45x.duckdns.org:62180
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4584-133-0x00000000001D0000-0x00000000001E2000-memory.dmp asyncrat behavioral2/files/0x003300000001ee7c-141.dat asyncrat behavioral2/files/0x003300000001ee7c-142.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 25d7952b3e8c9f0872ecf4f099cea1a2.exe -
Executes dropped EXE 1 IoCs
pid Process 4052 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3840 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2540 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe Token: SeDebugPrivilege 4052 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3652 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 82 PID 4584 wrote to memory of 3652 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 82 PID 4584 wrote to memory of 4860 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 83 PID 4584 wrote to memory of 4860 4584 25d7952b3e8c9f0872ecf4f099cea1a2.exe 83 PID 4860 wrote to memory of 2540 4860 cmd.exe 86 PID 4860 wrote to memory of 2540 4860 cmd.exe 86 PID 3652 wrote to memory of 3840 3652 cmd.exe 87 PID 3652 wrote to memory of 3840 3652 cmd.exe 87 PID 4860 wrote to memory of 4052 4860 cmd.exe 91 PID 4860 wrote to memory of 4052 4860 cmd.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d7952b3e8c9f0872ecf4f099cea1a2.exe"C:\Users\Admin\AppData\Local\Temp\25d7952b3e8c9f0872ecf4f099cea1a2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'3⤵
- Creates scheduled task(s)
PID:3840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E48.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2540
-
-
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD50a61c60c5d21e9fec07bff93a322200f
SHA18e48a2f8f59ea183da6581e18b2715d0a7d4b9cf
SHA2563dfc56440f0409f9fe2c4752ca80efba1144b5d2da80b02e1c74f181e8ad654d
SHA51240e6b76589d2cd23817bc1493397c72edfb1846fa64725637ddd1c828448eda22ff89628091f1d01b7af6a3858815abf91f5994f50ff4893cf355f7a8cc57be4
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb