Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 14:05
Static task
static1
Behavioral task
behavioral1
Sample
hkcmd.exe
Resource
win7-20230220-en
General
-
Target
hkcmd.exe
-
Size
691KB
-
MD5
dd505f7c59aa2882633c01034428e952
-
SHA1
12ffe4b71bdda14909f5d88301597f9cdf75ff94
-
SHA256
de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
-
SHA512
3c79eb968ce299b91d1c456f52c3a6cd2bfd75ae6ac8f6e35c56800e3d2e3f2ceec0e95545cb7cb6c6305e2a26ff1b681c65dd3470f1e9d16b8726e9c223ebd0
-
SSDEEP
12288:SrgDkO3hHlWxMzIHREJVk/bq4izoW/m7GloyLwo6s7pSCpCETtwpkZQ6b98I:SMA4hHlWxMiQW/O4ue7koUos1JpfhkX4
Malware Config
Extracted
asyncrat
0.5.7B
Default
191.101.130.205:6606
191.101.130.205:7707
191.101.130.205:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1120-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1120-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1120-75-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1120-77-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hkcmd.exedescription pid process target process PID 1144 set thread context of 1120 1144 hkcmd.exe hkcmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 472 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 472 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
hkcmd.exedescription pid process target process PID 1144 wrote to memory of 472 1144 hkcmd.exe powershell.exe PID 1144 wrote to memory of 472 1144 hkcmd.exe powershell.exe PID 1144 wrote to memory of 472 1144 hkcmd.exe powershell.exe PID 1144 wrote to memory of 472 1144 hkcmd.exe powershell.exe PID 1144 wrote to memory of 1736 1144 hkcmd.exe schtasks.exe PID 1144 wrote to memory of 1736 1144 hkcmd.exe schtasks.exe PID 1144 wrote to memory of 1736 1144 hkcmd.exe schtasks.exe PID 1144 wrote to memory of 1736 1144 hkcmd.exe schtasks.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe PID 1144 wrote to memory of 1120 1144 hkcmd.exe hkcmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RjBtcy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RjBtcy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC2C4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC2C4.tmpFilesize
1KB
MD580028b3456429d4c52c60e3d35328e3d
SHA1276ed1b051bf3fe4c0c76023db7ce2bd2a916339
SHA25640bd885ed5ef0875b82bdd5e103fa9d40f38127285bcd0b67dc2fd912f2db6d1
SHA512f14decf1ddcaaa95fe824b305ffd17a4ff9f4de59da2ea4e82f2f6d3acda709a81936254ed65c98025f9de87a30f877f050cc3ca0acf268cf2ebb2a7cf428c7a
-
memory/472-79-0x00000000026F0000-0x0000000002730000-memory.dmpFilesize
256KB
-
memory/472-78-0x00000000026F0000-0x0000000002730000-memory.dmpFilesize
256KB
-
memory/1120-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1120-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-80-0x0000000004780000-0x00000000047C0000-memory.dmpFilesize
256KB
-
memory/1120-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1144-54-0x0000000000D40000-0x0000000000DF2000-memory.dmpFilesize
712KB
-
memory/1144-58-0x0000000000BA0000-0x0000000000BAC000-memory.dmpFilesize
48KB
-
memory/1144-65-0x0000000004C20000-0x0000000004C34000-memory.dmpFilesize
80KB
-
memory/1144-57-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB
-
memory/1144-56-0x0000000000A00000-0x0000000000A12000-memory.dmpFilesize
72KB
-
memory/1144-55-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB
-
memory/1144-59-0x0000000004490000-0x00000000044DE000-memory.dmpFilesize
312KB