Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 14:51
Static task
static1
Behavioral task
behavioral1
Sample
07812999.exe
Resource
win7-20230220-en
General
-
Target
07812999.exe
-
Size
691KB
-
MD5
dd505f7c59aa2882633c01034428e952
-
SHA1
12ffe4b71bdda14909f5d88301597f9cdf75ff94
-
SHA256
de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
-
SHA512
3c79eb968ce299b91d1c456f52c3a6cd2bfd75ae6ac8f6e35c56800e3d2e3f2ceec0e95545cb7cb6c6305e2a26ff1b681c65dd3470f1e9d16b8726e9c223ebd0
-
SSDEEP
12288:SrgDkO3hHlWxMzIHREJVk/bq4izoW/m7GloyLwo6s7pSCpCETtwpkZQ6b98I:SMA4hHlWxMiQW/O4ue7koUos1JpfhkX4
Malware Config
Extracted
asyncrat
0.5.7B
Default
191.101.130.205:6606
191.101.130.205:7707
191.101.130.205:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1676-77-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/468-78-0x0000000002660000-0x00000000026A0000-memory.dmp asyncrat behavioral1/memory/1676-80-0x0000000000B40000-0x0000000000B80000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
07812999.exedescription pid process target process PID 1284 set thread context of 1676 1284 07812999.exe 07812999.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 468 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
07812999.exedescription pid process target process PID 1284 wrote to memory of 468 1284 07812999.exe powershell.exe PID 1284 wrote to memory of 468 1284 07812999.exe powershell.exe PID 1284 wrote to memory of 468 1284 07812999.exe powershell.exe PID 1284 wrote to memory of 468 1284 07812999.exe powershell.exe PID 1284 wrote to memory of 1296 1284 07812999.exe schtasks.exe PID 1284 wrote to memory of 1296 1284 07812999.exe schtasks.exe PID 1284 wrote to memory of 1296 1284 07812999.exe schtasks.exe PID 1284 wrote to memory of 1296 1284 07812999.exe schtasks.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe PID 1284 wrote to memory of 1676 1284 07812999.exe 07812999.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07812999.exe"C:\Users\Admin\AppData\Local\Temp\07812999.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RjBtcy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RjBtcy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB221.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\07812999.exe"C:\Users\Admin\AppData\Local\Temp\07812999.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB221.tmpFilesize
1KB
MD5d7c4e1083efde51475ae457b667b2d62
SHA15fc69a314f56fe999c6989489e63b80af68eeec3
SHA2566818eab36248b600a280f48e77cc02e8bb27eb98448ba47da2b5b28c467adc40
SHA512c3a48e0aadbb225d368da347f12ce206578655644fa8436b2379fffa4336f4f915f7c48cbe14684aecc51b62b6d7e21d4ac36b0803f1efe7d78a37bbd4fcfc81
-
memory/468-79-0x0000000002660000-0x00000000026A0000-memory.dmpFilesize
256KB
-
memory/468-78-0x0000000002660000-0x00000000026A0000-memory.dmpFilesize
256KB
-
memory/1284-54-0x0000000001270000-0x0000000001322000-memory.dmpFilesize
712KB
-
memory/1284-55-0x00000000011F0000-0x0000000001230000-memory.dmpFilesize
256KB
-
memory/1284-56-0x0000000000460000-0x0000000000472000-memory.dmpFilesize
72KB
-
memory/1284-57-0x00000000011F0000-0x0000000001230000-memory.dmpFilesize
256KB
-
memory/1284-58-0x0000000000970000-0x000000000097C000-memory.dmpFilesize
48KB
-
memory/1284-59-0x0000000005BF0000-0x0000000005C3E000-memory.dmpFilesize
312KB
-
memory/1284-65-0x0000000005120000-0x0000000005134000-memory.dmpFilesize
80KB
-
memory/1676-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1676-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1676-80-0x0000000000B40000-0x0000000000B80000-memory.dmpFilesize
256KB
-
memory/1676-81-0x0000000000B40000-0x0000000000B80000-memory.dmpFilesize
256KB