Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-05-2023 19:27
Behavioral task
behavioral1
Sample
clnt.exe
Resource
win7-20230220-en
General
-
Target
clnt.exe
-
Size
45KB
-
MD5
0b70981357d5208a08ed80e1e1f541c5
-
SHA1
7ab0b2df4ef0673357f7095aa94acb48a654bb35
-
SHA256
2bd07e7dea35698892a202c7d1e8c731f4d49db4b92cf96cdf3fdf3e2609d8ee
-
SHA512
027738657c8de6a2fa9a2eb0c9abfb3b9fe2b1212f224a787ad23c1f8bb4f053c464a32a0450227237066b48fe9aab1cadee9102b8fe917ad3188f5a50f45ea3
-
SSDEEP
768:vuCINTAolrhWU5TeLmo2qrs8V1TG1GcPIozjbbgX3ir+iewBDZXx:vuCINTA2G2J8Vk1Gho3bkXSPemdXx
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:55498
82.197.208.225:55498
192.168.1.186:55498
185.65.134.165:55498
xrxservices
-
delay
3
-
install
true
-
install_file
service.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-54-0x0000000000B50000-0x0000000000B62000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\service.exe asyncrat C:\Users\Admin\AppData\Roaming\service.exe asyncrat C:\Users\Admin\AppData\Roaming\service.exe asyncrat behavioral1/memory/1436-68-0x0000000000DE0000-0x0000000000DF2000-memory.dmp asyncrat behavioral1/memory/1436-69-0x0000000004F20000-0x0000000004F60000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
service.exepid process 1436 service.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1764 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1488 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
clnt.exepid process 1704 clnt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
clnt.exeservice.exedescription pid process Token: SeDebugPrivilege 1704 clnt.exe Token: SeDebugPrivilege 1436 service.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
clnt.execmd.execmd.exedescription pid process target process PID 1704 wrote to memory of 848 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 848 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 848 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 848 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 1764 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 1764 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 1764 1704 clnt.exe cmd.exe PID 1704 wrote to memory of 1764 1704 clnt.exe cmd.exe PID 848 wrote to memory of 1496 848 cmd.exe schtasks.exe PID 848 wrote to memory of 1496 848 cmd.exe schtasks.exe PID 848 wrote to memory of 1496 848 cmd.exe schtasks.exe PID 848 wrote to memory of 1496 848 cmd.exe schtasks.exe PID 1764 wrote to memory of 1488 1764 cmd.exe timeout.exe PID 1764 wrote to memory of 1488 1764 cmd.exe timeout.exe PID 1764 wrote to memory of 1488 1764 cmd.exe timeout.exe PID 1764 wrote to memory of 1488 1764 cmd.exe timeout.exe PID 1764 wrote to memory of 1436 1764 cmd.exe service.exe PID 1764 wrote to memory of 1436 1764 cmd.exe service.exe PID 1764 wrote to memory of 1436 1764 cmd.exe service.exe PID 1764 wrote to memory of 1436 1764 cmd.exe service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\clnt.exe"C:\Users\Admin\AppData\Local\Temp\clnt.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "service" /tr '"C:\Users\Admin\AppData\Roaming\service.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "service" /tr '"C:\Users\Admin\AppData\Roaming\service.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp207D.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp207D.tmp.batFilesize
151B
MD5b255ac4576940542511f99dd76f0ab9f
SHA1a75bbf179794f8727a2242b83e0246d619e0a036
SHA256a764c6f1699b4d8df573b7c83185a624e4b64aadc991a4af4f2159162e7f8255
SHA51296f76e1e35a3685856510d71bd8d13546e85c6e0d3a1f856307490db07858477f8f5b247e66202b7041abb6565483e8101b9ea3ee512c0cbffde9790d089a79e
-
C:\Users\Admin\AppData\Local\Temp\tmp207D.tmp.batFilesize
151B
MD5b255ac4576940542511f99dd76f0ab9f
SHA1a75bbf179794f8727a2242b83e0246d619e0a036
SHA256a764c6f1699b4d8df573b7c83185a624e4b64aadc991a4af4f2159162e7f8255
SHA51296f76e1e35a3685856510d71bd8d13546e85c6e0d3a1f856307490db07858477f8f5b247e66202b7041abb6565483e8101b9ea3ee512c0cbffde9790d089a79e
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
45KB
MD50b70981357d5208a08ed80e1e1f541c5
SHA17ab0b2df4ef0673357f7095aa94acb48a654bb35
SHA2562bd07e7dea35698892a202c7d1e8c731f4d49db4b92cf96cdf3fdf3e2609d8ee
SHA512027738657c8de6a2fa9a2eb0c9abfb3b9fe2b1212f224a787ad23c1f8bb4f053c464a32a0450227237066b48fe9aab1cadee9102b8fe917ad3188f5a50f45ea3
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
45KB
MD50b70981357d5208a08ed80e1e1f541c5
SHA17ab0b2df4ef0673357f7095aa94acb48a654bb35
SHA2562bd07e7dea35698892a202c7d1e8c731f4d49db4b92cf96cdf3fdf3e2609d8ee
SHA512027738657c8de6a2fa9a2eb0c9abfb3b9fe2b1212f224a787ad23c1f8bb4f053c464a32a0450227237066b48fe9aab1cadee9102b8fe917ad3188f5a50f45ea3
-
\Users\Admin\AppData\Roaming\service.exeFilesize
45KB
MD50b70981357d5208a08ed80e1e1f541c5
SHA17ab0b2df4ef0673357f7095aa94acb48a654bb35
SHA2562bd07e7dea35698892a202c7d1e8c731f4d49db4b92cf96cdf3fdf3e2609d8ee
SHA512027738657c8de6a2fa9a2eb0c9abfb3b9fe2b1212f224a787ad23c1f8bb4f053c464a32a0450227237066b48fe9aab1cadee9102b8fe917ad3188f5a50f45ea3
-
memory/1436-68-0x0000000000DE0000-0x0000000000DF2000-memory.dmpFilesize
72KB
-
memory/1436-69-0x0000000004F20000-0x0000000004F60000-memory.dmpFilesize
256KB
-
memory/1436-70-0x0000000004F20000-0x0000000004F60000-memory.dmpFilesize
256KB
-
memory/1704-54-0x0000000000B50000-0x0000000000B62000-memory.dmpFilesize
72KB
-
memory/1704-55-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB