Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/06/2023, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
07812999.exe
Resource
win7-20230220-en
General
-
Target
07812999.exe
-
Size
691KB
-
MD5
dd505f7c59aa2882633c01034428e952
-
SHA1
12ffe4b71bdda14909f5d88301597f9cdf75ff94
-
SHA256
de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
-
SHA512
3c79eb968ce299b91d1c456f52c3a6cd2bfd75ae6ac8f6e35c56800e3d2e3f2ceec0e95545cb7cb6c6305e2a26ff1b681c65dd3470f1e9d16b8726e9c223ebd0
-
SSDEEP
12288:SrgDkO3hHlWxMzIHREJVk/bq4izoW/m7GloyLwo6s7pSCpCETtwpkZQ6b98I:SMA4hHlWxMiQW/O4ue7koUos1JpfhkX4
Malware Config
Extracted
asyncrat
0.5.7B
Default
191.101.130.205:6606
191.101.130.205:7707
191.101.130.205:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
resource yara_rule behavioral1/memory/1676-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-77-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/468-78-0x0000000002660000-0x00000000026A0000-memory.dmp asyncrat behavioral1/memory/1676-80-0x0000000000B40000-0x0000000000B80000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1284 set thread context of 1676 1284 07812999.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 468 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1284 wrote to memory of 468 1284 07812999.exe 28 PID 1284 wrote to memory of 468 1284 07812999.exe 28 PID 1284 wrote to memory of 468 1284 07812999.exe 28 PID 1284 wrote to memory of 468 1284 07812999.exe 28 PID 1284 wrote to memory of 1296 1284 07812999.exe 30 PID 1284 wrote to memory of 1296 1284 07812999.exe 30 PID 1284 wrote to memory of 1296 1284 07812999.exe 30 PID 1284 wrote to memory of 1296 1284 07812999.exe 30 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32 PID 1284 wrote to memory of 1676 1284 07812999.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\07812999.exe"C:\Users\Admin\AppData\Local\Temp\07812999.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RjBtcy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RjBtcy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB221.tmp"2⤵
- Creates scheduled task(s)
PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\07812999.exe"C:\Users\Admin\AppData\Local\Temp\07812999.exe"2⤵PID:1676
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d7c4e1083efde51475ae457b667b2d62
SHA15fc69a314f56fe999c6989489e63b80af68eeec3
SHA2566818eab36248b600a280f48e77cc02e8bb27eb98448ba47da2b5b28c467adc40
SHA512c3a48e0aadbb225d368da347f12ce206578655644fa8436b2379fffa4336f4f915f7c48cbe14684aecc51b62b6d7e21d4ac36b0803f1efe7d78a37bbd4fcfc81