Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 14:07
Static task
static1
Behavioral task
behavioral1
Sample
hkcmd.exe
Resource
win7-20230220-en
General
-
Target
hkcmd.exe
-
Size
691KB
-
MD5
dd505f7c59aa2882633c01034428e952
-
SHA1
12ffe4b71bdda14909f5d88301597f9cdf75ff94
-
SHA256
de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
-
SHA512
3c79eb968ce299b91d1c456f52c3a6cd2bfd75ae6ac8f6e35c56800e3d2e3f2ceec0e95545cb7cb6c6305e2a26ff1b681c65dd3470f1e9d16b8726e9c223ebd0
-
SSDEEP
12288:SrgDkO3hHlWxMzIHREJVk/bq4izoW/m7GloyLwo6s7pSCpCETtwpkZQ6b98I:SMA4hHlWxMiQW/O4ue7koUos1JpfhkX4
Malware Config
Extracted
asyncrat
0.5.7B
Default
191.101.130.205:6606
191.101.130.205:7707
191.101.130.205:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1224-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1224-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1224-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1224-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1224-75-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/680-78-0x0000000002740000-0x0000000002780000-memory.dmp asyncrat behavioral1/memory/680-79-0x0000000002740000-0x0000000002780000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hkcmd.exedescription pid process target process PID 1744 set thread context of 1224 1744 hkcmd.exe hkcmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 680 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
hkcmd.exedescription pid process target process PID 1744 wrote to memory of 680 1744 hkcmd.exe powershell.exe PID 1744 wrote to memory of 680 1744 hkcmd.exe powershell.exe PID 1744 wrote to memory of 680 1744 hkcmd.exe powershell.exe PID 1744 wrote to memory of 680 1744 hkcmd.exe powershell.exe PID 1744 wrote to memory of 1148 1744 hkcmd.exe schtasks.exe PID 1744 wrote to memory of 1148 1744 hkcmd.exe schtasks.exe PID 1744 wrote to memory of 1148 1744 hkcmd.exe schtasks.exe PID 1744 wrote to memory of 1148 1744 hkcmd.exe schtasks.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe PID 1744 wrote to memory of 1224 1744 hkcmd.exe hkcmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RjBtcy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RjBtcy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB175.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"C:\Users\Admin\AppData\Local\Temp\hkcmd.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB175.tmpFilesize
1KB
MD5bd99f37e575b2d93706e1b84699b7222
SHA13f2984468130ed1376dda9fed845054ed5219edd
SHA256b6923d3b384cc531c01c86c664cb14ffec94209728b205f287362760d5cb0e11
SHA512dfe5fd7bc5711e63524b552f6091fb0be4e7853c8c7ac925b87f47d54a435ddca5f0525f86aeda1d11e53d7ab54ab61df6aeb620d5c1668837707fc6a149cba9
-
memory/680-80-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/680-79-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/680-78-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/1224-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-81-0x0000000002170000-0x00000000021B0000-memory.dmpFilesize
256KB
-
memory/1224-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1224-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1744-59-0x0000000004C70000-0x0000000004CBE000-memory.dmpFilesize
312KB
-
memory/1744-65-0x0000000004D30000-0x0000000004D44000-memory.dmpFilesize
80KB
-
memory/1744-54-0x00000000009E0000-0x0000000000A92000-memory.dmpFilesize
712KB
-
memory/1744-57-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1744-56-0x00000000007E0000-0x00000000007F2000-memory.dmpFilesize
72KB
-
memory/1744-55-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/1744-58-0x00000000007F0000-0x00000000007FC000-memory.dmpFilesize
48KB