Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2023 07:12
Static task
static1
Behavioral task
behavioral1
Sample
06211199.exe
Resource
win7-20230220-en
General
-
Target
06211199.exe
-
Size
787KB
-
MD5
0e6861c721b9342f69eba894703f6484
-
SHA1
6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
-
SHA256
fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
-
SHA512
6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
-
SSDEEP
6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
Malware Config
Extracted
asyncrat
0.5.7B
Default
fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
logs.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4444-144-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
06211199.exe06211199.exelogs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 06211199.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 06211199.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation logs.exe -
Executes dropped EXE 2 IoCs
Processes:
logs.exelogs.exepid process 4592 logs.exe 2276 logs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
06211199.exelogs.exedescription pid process target process PID 4156 set thread context of 4444 4156 06211199.exe 06211199.exe PID 4592 set thread context of 2276 4592 logs.exe logs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1676 schtasks.exe 388 schtasks.exe 4632 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3788 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
06211199.exe06211199.exelogs.exepid process 4156 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4444 06211199.exe 4592 logs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
06211199.exe06211199.exelogs.exelogs.exedescription pid process Token: SeDebugPrivilege 4156 06211199.exe Token: SeDebugPrivilege 4444 06211199.exe Token: SeDebugPrivilege 4592 logs.exe Token: SeDebugPrivilege 2276 logs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
06211199.exe06211199.execmd.execmd.exelogs.exedescription pid process target process PID 4156 wrote to memory of 1676 4156 06211199.exe schtasks.exe PID 4156 wrote to memory of 1676 4156 06211199.exe schtasks.exe PID 4156 wrote to memory of 1676 4156 06211199.exe schtasks.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4156 wrote to memory of 4444 4156 06211199.exe 06211199.exe PID 4444 wrote to memory of 1608 4444 06211199.exe cmd.exe PID 4444 wrote to memory of 1608 4444 06211199.exe cmd.exe PID 4444 wrote to memory of 1608 4444 06211199.exe cmd.exe PID 4444 wrote to memory of 3552 4444 06211199.exe cmd.exe PID 4444 wrote to memory of 3552 4444 06211199.exe cmd.exe PID 4444 wrote to memory of 3552 4444 06211199.exe cmd.exe PID 1608 wrote to memory of 388 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 388 1608 cmd.exe schtasks.exe PID 1608 wrote to memory of 388 1608 cmd.exe schtasks.exe PID 3552 wrote to memory of 3788 3552 cmd.exe timeout.exe PID 3552 wrote to memory of 3788 3552 cmd.exe timeout.exe PID 3552 wrote to memory of 3788 3552 cmd.exe timeout.exe PID 3552 wrote to memory of 4592 3552 cmd.exe logs.exe PID 3552 wrote to memory of 4592 3552 cmd.exe logs.exe PID 3552 wrote to memory of 4592 3552 cmd.exe logs.exe PID 4592 wrote to memory of 4632 4592 logs.exe schtasks.exe PID 4592 wrote to memory of 4632 4592 logs.exe schtasks.exe PID 4592 wrote to memory of 4632 4592 logs.exe schtasks.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe PID 4592 wrote to memory of 2276 4592 logs.exe logs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"C:\Users\Admin\AppData\Local\Temp\06211199.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3671.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F49.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\logs.exe"C:\Users\Admin\AppData\Roaming\logs.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF647.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\logs.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\06211199.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\logs.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Temp\tmp3671.tmpFilesize
1KB
MD57c27a5d2da94a8aed05fde63c0817d8e
SHA128772197bdd1517aaaed21f7e62e9d0202d8bd77
SHA256a8960c3c70fd294b56e5e9cd0f0b5953337dcb2dd4c78e8b4b44c3e1cbc37945
SHA512e081335ce8fdcf6455dc07f881785ad438a1ddac8c5a7d97d2779f45f13859d739cf9e2e37629e833bf72b4ac18c20d23aeb8dab5477a3e69e11213f1790e291
-
C:\Users\Admin\AppData\Local\Temp\tmp4F49.tmp.batFilesize
148B
MD59940e204e63fec0f7f71b18459e9b3f6
SHA12d08f386ff9bef6b0585c057873360ff84c90ef9
SHA256ee86a91eb6f00719750712197e6232a75515184ff2fe3d1485c400ec47e6c875
SHA51265cac04a2f25782a95d8ac4e30a281f31b96c92255d7311664aeaaab3e72dfa636455a4a44eddf193bd4b6e5bf6da40077f5b787086084040c26afddae924330
-
C:\Users\Admin\AppData\Local\Temp\tmpF647.tmpFilesize
1KB
MD57c27a5d2da94a8aed05fde63c0817d8e
SHA128772197bdd1517aaaed21f7e62e9d0202d8bd77
SHA256a8960c3c70fd294b56e5e9cd0f0b5953337dcb2dd4c78e8b4b44c3e1cbc37945
SHA512e081335ce8fdcf6455dc07f881785ad438a1ddac8c5a7d97d2779f45f13859d739cf9e2e37629e833bf72b4ac18c20d23aeb8dab5477a3e69e11213f1790e291
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
787KB
MD50e6861c721b9342f69eba894703f6484
SHA16c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA256fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
SHA5126beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
787KB
MD50e6861c721b9342f69eba894703f6484
SHA16c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA256fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
SHA5126beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
787KB
MD50e6861c721b9342f69eba894703f6484
SHA16c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA256fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
SHA5126beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
-
memory/2276-164-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/2276-163-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/4156-138-0x0000000005050000-0x00000000050A6000-memory.dmpFilesize
344KB
-
memory/4156-140-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/4156-139-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/4156-133-0x00000000002E0000-0x00000000003AC000-memory.dmpFilesize
816KB
-
memory/4156-137-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/4156-136-0x0000000004E60000-0x0000000004EF2000-memory.dmpFilesize
584KB
-
memory/4156-135-0x0000000005370000-0x0000000005914000-memory.dmpFilesize
5.6MB
-
memory/4156-134-0x0000000004D20000-0x0000000004DBC000-memory.dmpFilesize
624KB
-
memory/4444-147-0x0000000005020000-0x0000000005030000-memory.dmpFilesize
64KB
-
memory/4444-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4592-155-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4592-156-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB