Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2023 09:16
Static task
static1
Behavioral task
behavioral1
Sample
New Order SSRNSSIQ102-2023.exe
Resource
win7-20230220-en
General
-
Target
New Order SSRNSSIQ102-2023.exe
-
Size
789KB
-
MD5
40e90e03d1c397d3fede4c0e9d3dd2e4
-
SHA1
2ca12b01d5a31dd2076a7a4c0ca70fb61451331c
-
SHA256
92b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
-
SHA512
a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
SSDEEP
12288:fCBNfZFHB3gwr+1yjPHx0HGkYDHjrTCq:abHBQyjPHxqYDH/eq
Malware Config
Extracted
asyncrat
0.5.7B
Default
fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
logs.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4476-144-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Order SSRNSSIQ102-2023.exelogs.exeNew Order SSRNSSIQ102-2023.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation New Order SSRNSSIQ102-2023.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation logs.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation New Order SSRNSSIQ102-2023.exe -
Executes dropped EXE 2 IoCs
Processes:
logs.exelogs.exepid process 2804 logs.exe 3160 logs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
New Order SSRNSSIQ102-2023.exelogs.exedescription pid process target process PID 4220 set thread context of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 2804 set thread context of 3160 2804 logs.exe logs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2024 schtasks.exe 2240 schtasks.exe 2872 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3424 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
New Order SSRNSSIQ102-2023.exelogs.exepid process 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 4476 New Order SSRNSSIQ102-2023.exe 2804 logs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New Order SSRNSSIQ102-2023.exeNew Order SSRNSSIQ102-2023.exelogs.exelogs.exedescription pid process Token: SeDebugPrivilege 4220 New Order SSRNSSIQ102-2023.exe Token: SeDebugPrivilege 4476 New Order SSRNSSIQ102-2023.exe Token: SeDebugPrivilege 2804 logs.exe Token: SeDebugPrivilege 3160 logs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
New Order SSRNSSIQ102-2023.exeNew Order SSRNSSIQ102-2023.execmd.execmd.exelogs.exedescription pid process target process PID 4220 wrote to memory of 2024 4220 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 4220 wrote to memory of 2024 4220 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 4220 wrote to memory of 2024 4220 New Order SSRNSSIQ102-2023.exe schtasks.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4220 wrote to memory of 4476 4220 New Order SSRNSSIQ102-2023.exe New Order SSRNSSIQ102-2023.exe PID 4476 wrote to memory of 2072 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 4476 wrote to memory of 2072 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 4476 wrote to memory of 2072 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 4476 wrote to memory of 5040 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 4476 wrote to memory of 5040 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 4476 wrote to memory of 5040 4476 New Order SSRNSSIQ102-2023.exe cmd.exe PID 5040 wrote to memory of 3424 5040 cmd.exe timeout.exe PID 5040 wrote to memory of 3424 5040 cmd.exe timeout.exe PID 5040 wrote to memory of 3424 5040 cmd.exe timeout.exe PID 2072 wrote to memory of 2240 2072 cmd.exe schtasks.exe PID 2072 wrote to memory of 2240 2072 cmd.exe schtasks.exe PID 2072 wrote to memory of 2240 2072 cmd.exe schtasks.exe PID 5040 wrote to memory of 2804 5040 cmd.exe logs.exe PID 5040 wrote to memory of 2804 5040 cmd.exe logs.exe PID 5040 wrote to memory of 2804 5040 cmd.exe logs.exe PID 2804 wrote to memory of 2872 2804 logs.exe schtasks.exe PID 2804 wrote to memory of 2872 2804 logs.exe schtasks.exe PID 2804 wrote to memory of 2872 2804 logs.exe schtasks.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe PID 2804 wrote to memory of 3160 2804 logs.exe logs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSapQxocQt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp26B2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Order SSRNSSIQ102-2023.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3CAB.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\logs.exe"C:\Users\Admin\AppData\Roaming\logs.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSapQxocQt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\logs.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order SSRNSSIQ102-2023.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\logs.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Temp\tmp26B2.tmpFilesize
1KB
MD5513766ab120f484dfdd0a87b4695effb
SHA1a8cd9132a1f64d3692b7e2046d8c20f0eb574f9a
SHA2565f24273553e120873d4cd22bafd04a39b5715a522d257ba6c0befbf920887a2b
SHA5128d11ec0aa3590d0a9f226fd943605ef9ee672558328455347843cad8552e0f7e344a80ea3d492d026f29d4e27695872ecf4802dc1f7b93b867e3378a22f74eaa
-
C:\Users\Admin\AppData\Local\Temp\tmp3CAB.tmp.batFilesize
148B
MD5dbeb567a4ff590da3c159d33d6191009
SHA1e0ea5fe5dd4be3f47cabf7a8d61d436b0cebd2da
SHA2566d68e2875122babaf3c3791e01eca598a4b59fb10ceac39c748db3eaf566a698
SHA5127be031cb3c11fe55e73a85617d0a185fac59d33e111bf30793cc1d22d536cee8b2151eb973a076ee5093a39fe0940abd350e8b6e4ba593423aaff230add90c24
-
C:\Users\Admin\AppData\Local\Temp\tmpE2BF.tmpFilesize
1KB
MD5513766ab120f484dfdd0a87b4695effb
SHA1a8cd9132a1f64d3692b7e2046d8c20f0eb574f9a
SHA2565f24273553e120873d4cd22bafd04a39b5715a522d257ba6c0befbf920887a2b
SHA5128d11ec0aa3590d0a9f226fd943605ef9ee672558328455347843cad8552e0f7e344a80ea3d492d026f29d4e27695872ecf4802dc1f7b93b867e3378a22f74eaa
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
789KB
MD540e90e03d1c397d3fede4c0e9d3dd2e4
SHA12ca12b01d5a31dd2076a7a4c0ca70fb61451331c
SHA25692b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e
SHA512a4f9ffb09d118407d3d63a116f5edcdb2a2e21176eed80984a2b323f1360771b14c0816ac6c8a66650d584993f0206f7c9f82504a59fdf3e222d76e7a88c80f6
-
memory/2804-155-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/2804-156-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/3160-164-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/3160-163-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/4220-133-0x0000000000710000-0x00000000007DC000-memory.dmpFilesize
816KB
-
memory/4220-138-0x0000000005530000-0x0000000005586000-memory.dmpFilesize
344KB
-
memory/4220-137-0x0000000005190000-0x000000000519A000-memory.dmpFilesize
40KB
-
memory/4220-139-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/4220-136-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/4220-135-0x0000000005840000-0x0000000005DE4000-memory.dmpFilesize
5.6MB
-
memory/4220-134-0x00000000051F0000-0x000000000528C000-memory.dmpFilesize
624KB
-
memory/4220-140-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/4476-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4476-147-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB