Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-06-2023 09:16
Static task
static1
Behavioral task
behavioral1
Sample
New Order SSRNSSIQ102-2023.exe
Resource
win7-20230220-en
General
-
Target
New Order SSRNSSIQ102-2023.exe
-
Size
789KB
-
MD5
40e90e03d1c397d3fede4c0e9d3dd2e4
-
SHA1
2ca12b01d5a31dd2076a7a4c0ca70fb61451331c
-
SHA256
92b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
-
SHA512
a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
SSDEEP
12288:fCBNfZFHB3gwr+1yjPHx0HGkYDHjrTCq:abHBQyjPHxqYDH/eq
Malware Config
Extracted
asyncrat
0.5.7B
Default
fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
logs.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1320-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1320-73-0x0000000004E00000-0x0000000004E40000-memory.dmp asyncrat behavioral1/memory/732-100-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/732-102-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/732-103-0x0000000001080000-0x00000000010C0000-memory.dmp asyncrat behavioral1/memory/732-104-0x0000000001080000-0x00000000010C0000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
logs.exelogs.exepid process 1884 logs.exe 732 logs.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1460 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
New Order SSRNSSIQ102-2023.exelogs.exedescription pid process target process PID 944 set thread context of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 1884 set thread context of 732 1884 logs.exe logs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1720 schtasks.exe 2024 schtasks.exe 1880 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 936 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
New Order SSRNSSIQ102-2023.exeNew Order SSRNSSIQ102-2023.exelogs.exepid process 944 New Order SSRNSSIQ102-2023.exe 944 New Order SSRNSSIQ102-2023.exe 944 New Order SSRNSSIQ102-2023.exe 1320 New Order SSRNSSIQ102-2023.exe 1884 logs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New Order SSRNSSIQ102-2023.exeNew Order SSRNSSIQ102-2023.exelogs.exelogs.exedescription pid process Token: SeDebugPrivilege 944 New Order SSRNSSIQ102-2023.exe Token: SeDebugPrivilege 1320 New Order SSRNSSIQ102-2023.exe Token: SeDebugPrivilege 1884 logs.exe Token: SeDebugPrivilege 732 logs.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
New Order SSRNSSIQ102-2023.exeNew Order SSRNSSIQ102-2023.execmd.execmd.exelogs.exedescription pid process target process PID 944 wrote to memory of 2024 944 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 944 wrote to memory of 2024 944 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 944 wrote to memory of 2024 944 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 944 wrote to memory of 2024 944 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 944 wrote to memory of 868 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 868 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 868 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 868 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 864 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 864 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 864 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 864 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 944 wrote to memory of 1320 944 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 1320 wrote to memory of 476 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 476 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 476 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 476 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 1460 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 1460 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 1460 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 1320 wrote to memory of 1460 1320 New Order SSRNSSIQ102-2023.exe cmd.exe PID 476 wrote to memory of 1880 476 cmd.exe schtasks.exe PID 476 wrote to memory of 1880 476 cmd.exe schtasks.exe PID 476 wrote to memory of 1880 476 cmd.exe schtasks.exe PID 476 wrote to memory of 1880 476 cmd.exe schtasks.exe PID 1460 wrote to memory of 936 1460 cmd.exe timeout.exe PID 1460 wrote to memory of 936 1460 cmd.exe timeout.exe PID 1460 wrote to memory of 936 1460 cmd.exe timeout.exe PID 1460 wrote to memory of 936 1460 cmd.exe timeout.exe PID 1460 wrote to memory of 1884 1460 cmd.exe logs.exe PID 1460 wrote to memory of 1884 1460 cmd.exe logs.exe PID 1460 wrote to memory of 1884 1460 cmd.exe logs.exe PID 1460 wrote to memory of 1884 1460 cmd.exe logs.exe PID 1884 wrote to memory of 1720 1884 logs.exe schtasks.exe PID 1884 wrote to memory of 1720 1884 logs.exe schtasks.exe PID 1884 wrote to memory of 1720 1884 logs.exe schtasks.exe PID 1884 wrote to memory of 1720 1884 logs.exe schtasks.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe PID 1884 wrote to memory of 732 1884 logs.exe logs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSapQxocQt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1804.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp38FC.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\logs.exe"C:\Users\Admin\AppData\Roaming\logs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSapQxocQt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF9BB.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\logs.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1804.tmpFilesize
1KB
MD5d99488839a3539152e833113a575579d
SHA1db475510176a4178004d5be8b164bc5ddc0e0337
SHA2567517e1ce4822f1d238cd6717d8e942dffdf20f3816e5fdf53dc54ac4d3b87f94
SHA5120d2d6d61ffc8eab7e5448e6ab358deb7c5fef661402c467e7a621123fa53d24757d63d533bd8ce8e31d539eb0d48d5e5ec7d8c7561035bae54274910c741e458
-
C:\Users\Admin\AppData\Local\Temp\tmp38FC.tmp.batFilesize
148B
MD5bd938962b7be81b6d4cd673a31c2b7cf
SHA17d3b79efbc43c1e450096c5b6a75519f7fdf0840
SHA256a9bde784c994326ad982c233a6e37a711aff231c4f6650d98c55651b31bd533b
SHA512019e7c45dadeff52006ea481296bc8f0fac480aec2453a948213ef9bf78e45afb970454775509d44a0c45fc87d3236c6cb513a22cf1c5c4f8d49eb0ba3dd5923
-
C:\Users\Admin\AppData\Local\Temp\tmp38FC.tmp.batFilesize
148B
MD5bd938962b7be81b6d4cd673a31c2b7cf
SHA17d3b79efbc43c1e450096c5b6a75519f7fdf0840
SHA256a9bde784c994326ad982c233a6e37a711aff231c4f6650d98c55651b31bd533b
SHA512019e7c45dadeff52006ea481296bc8f0fac480aec2453a948213ef9bf78e45afb970454775509d44a0c45fc87d3236c6cb513a22cf1c5c4f8d49eb0ba3dd5923
-
C:\Users\Admin\AppData\Local\Temp\tmpF9BB.tmpFilesize
1KB
MD5d99488839a3539152e833113a575579d
SHA1db475510176a4178004d5be8b164bc5ddc0e0337
SHA2567517e1ce4822f1d238cd6717d8e942dffdf20f3816e5fdf53dc54ac4d3b87f94
SHA5120d2d6d61ffc8eab7e5448e6ab358deb7c5fef661402c467e7a621123fa53d24757d63d533bd8ce8e31d539eb0d48d5e5ec7d8c7561035bae54274910c741e458
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
memory/732-96-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/732-104-0x0000000001080000-0x00000000010C0000-memory.dmpFilesize
256KB
-
memory/732-103-0x0000000001080000-0x00000000010C0000-memory.dmpFilesize
256KB
-
memory/732-102-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/732-100-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-58-0x00000000020E0000-0x0000000002146000-memory.dmpFilesize
408KB
-
memory/944-54-0x00000000001B0000-0x000000000027C000-memory.dmpFilesize
816KB
-
memory/944-59-0x00000000004B0000-0x00000000004C2000-memory.dmpFilesize
72KB
-
memory/944-57-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/944-56-0x00000000006A0000-0x00000000006E0000-memory.dmpFilesize
256KB
-
memory/944-55-0x00000000006A0000-0x00000000006E0000-memory.dmpFilesize
256KB
-
memory/1320-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-73-0x0000000004E00000-0x0000000004E40000-memory.dmpFilesize
256KB
-
memory/1320-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1320-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1320-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1884-86-0x0000000001100000-0x00000000011CC000-memory.dmpFilesize
816KB
-
memory/1884-87-0x0000000004960000-0x00000000049A0000-memory.dmpFilesize
256KB
-
memory/1884-88-0x0000000004960000-0x00000000049A0000-memory.dmpFilesize
256KB
-
memory/1884-89-0x0000000000540000-0x0000000000552000-memory.dmpFilesize
72KB