Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 01:29
Behavioral task
behavioral1
Sample
1240-55-0x0000000000370000-0x0000000000382000-memory.exe
Resource
win7-20230220-en
General
-
Target
1240-55-0x0000000000370000-0x0000000000382000-memory.exe
-
Size
72KB
-
MD5
6ddcee176a864b67cd4cff577c28cdf1
-
SHA1
c69292e4ec9128ccc4de351f39a48d1bd3f439e6
-
SHA256
5bf8102edefe3e55a0e33207fdbf359f71477f70856745bc4e626cc72d498cd6
-
SHA512
3482d4da78c96ca3d404d97547ee21ff1651339bb5ae01f107399705f6a73bbd26e1f0a0761b0625427373cc688812e43483774a754c1f9a0bce9ff16e322ff4
-
SSDEEP
768:8oXyvMOgs2/W4G9mxNf13wRCn1OCDyjb5gr3irIWSpo7niClZR2tYcFmVc6K:8oX4MOg/PAUVebWrSvSpurRKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
ycwqfldbyykswbufnmb
-
delay
5
-
install
true
-
install_file
microsafte.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/3476-133-0x0000000000BB0000-0x0000000000BC2000-memory.dmp asyncrat behavioral2/files/0x0007000000022d0c-141.dat asyncrat behavioral2/files/0x0007000000022d0c-142.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation 1240-55-0x0000000000370000-0x0000000000382000-memory.exe -
Executes dropped EXE 1 IoCs
pid Process 1156 microsafte.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 748 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 436 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe Token: SeDebugPrivilege 1156 microsafte.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3476 wrote to memory of 1572 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 85 PID 3476 wrote to memory of 1572 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 85 PID 3476 wrote to memory of 1476 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 87 PID 3476 wrote to memory of 1476 3476 1240-55-0x0000000000370000-0x0000000000382000-memory.exe 87 PID 1476 wrote to memory of 436 1476 cmd.exe 90 PID 1476 wrote to memory of 436 1476 cmd.exe 90 PID 1572 wrote to memory of 748 1572 cmd.exe 89 PID 1572 wrote to memory of 748 1572 cmd.exe 89 PID 1476 wrote to memory of 1156 1476 cmd.exe 92 PID 1476 wrote to memory of 1156 1476 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1240-55-0x0000000000370000-0x0000000000382000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1240-55-0x0000000000370000-0x0000000000382000-memory.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1240-55-0x0000000000370000-0x0000000000382000-memory /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 1240-55-0x0000000000370000-0x0000000000382000-memory /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"'3⤵
- Creates scheduled task(s)
PID:748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE004.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:436
-
-
C:\Users\Admin\AppData\Roaming\microsafte.exe"C:\Users\Admin\AppData\Roaming\microsafte.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD54ac1dd2cc7b2bc47577cb14c9f733d6a
SHA1eeadef940caee9c16b93de6c4ce360524497e2b2
SHA256b7fe65bd264f3f8ea4d9ce73040233efa7edb474f669bd44320a56b62b31a0bb
SHA5125ade27ec7af9dc2246894dbd24fa27ab52517a669881e24a9ed56d50a4e9f553d67283e9a062181fcd4cdb0d47c870e773daa2c1277d70af1bef55c1a18b5378
-
Filesize
72KB
MD56ddcee176a864b67cd4cff577c28cdf1
SHA1c69292e4ec9128ccc4de351f39a48d1bd3f439e6
SHA2565bf8102edefe3e55a0e33207fdbf359f71477f70856745bc4e626cc72d498cd6
SHA5123482d4da78c96ca3d404d97547ee21ff1651339bb5ae01f107399705f6a73bbd26e1f0a0761b0625427373cc688812e43483774a754c1f9a0bce9ff16e322ff4
-
Filesize
72KB
MD56ddcee176a864b67cd4cff577c28cdf1
SHA1c69292e4ec9128ccc4de351f39a48d1bd3f439e6
SHA2565bf8102edefe3e55a0e33207fdbf359f71477f70856745bc4e626cc72d498cd6
SHA5123482d4da78c96ca3d404d97547ee21ff1651339bb5ae01f107399705f6a73bbd26e1f0a0761b0625427373cc688812e43483774a754c1f9a0bce9ff16e322ff4