Analysis
- max time kernel
83s - max time network
87s - platform
windows7_x64 - resource
win7-20230703-en - resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system - submitted
07/07/2023, 13:55
Behavioral task
behavioral1
Sample
decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
Resource
win7-20230703-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
- Size 47KB
- Sample230707-q74hdsaf4v
- SHA256 76ded83d3b20de4cab65576d0e4c5adcd5b8ebb76e064ef4c2d3449ebdd25cac
- MD5 86c1fef12c75d7765f96defa9c7f58f3
- SHA1 304c6a7fbe66e820d4aa5f2132f3b3c2179ab080
- SHA512 4be07c224b4b856aa09ae12911bd7f7c2869c83649bdc5d13c3bbd9d797736ff4ab558ea33ef9b22c086551a99420a8d1cd1a6ec08b8e01f421405142bd3c129
- SSDEEP 768:JOEuILWCKi+DiVWD+RPpiDy8Yb7geEwjxU3OlojvEgK/JjZVc6KN:JOtmVWCR3zbEZw+38ojnkJjZVclN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
6JULIO-PJOAOJS
C2
-
20.200.63.2:2727
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 3 IoCs
resource yara_rule behavioral1/memory/3044-54-0x0000000000D50000-0x0000000000D62000-memory.dmp asyncrat behavioral1/memory/3044-73-0x00000000004F0000-0x000000000050E000-memory.dmp asyncrat behavioral1/memory/3044-489-0x000000001A280000-0x000000001A2E4000-memory.dmp asyncrat - Renames multiple (198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2492 cmd.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\ado\msado15.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\PipeTran.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2428 timeout.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3044 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2492 3044 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe 29 PID 3044 wrote to memory of 2492 3044 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe 29 PID 3044 wrote to memory of 2492 3044 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe 29 PID 2492 wrote to memory of 2428 2492 cmd.exe 31 PID 2492 wrote to memory of 2428 2492 cmd.exe 31 PID 2492 wrote to memory of 2428 2492 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe"C:\Users\Admin\AppData\Local\Temp\decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5DF5.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2428
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Cab3843.tmp
- Size 62KB
- SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
- MD5 3ac860860707baaf32469fa7cc7c0192
- SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
- SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
- SSDEEP 1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarE0A5.tmp
- Size 164KB
- SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
- MD5 4ff65ad929cd9a367680e0e5b1c08166
- SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
- SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
- SSDEEP 1536:FUdJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6t0:FIJXq0Rn5JaJkHru2h2jCEvt2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp5DF5.tmp.bat
- Size 223B
- SHA256 fab604cab3e2727b6d1032605600f78dda8320539a6dfa6526ce063a56cc29de
- MD5 686fbc93a0a0ad435ecb4405c787029c
- SHA1 6c0b10ea067740fc379a939d43807c1436700ca3
- SHA512 6db209ab8f4b7a16056a1690e5f99b23ed86ec14e1bf895077a26db949d05d27316b00cf5bfe65f32bdb892f3467cd643421d1d0fb1b5906d84fa48d18d2b38b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmp5DF5.tmp.bat
- Size 223B
- SHA256 fab604cab3e2727b6d1032605600f78dda8320539a6dfa6526ce063a56cc29de
- MD5 686fbc93a0a0ad435ecb4405c787029c
- SHA1 6c0b10ea067740fc379a939d43807c1436700ca3
- SHA512 6db209ab8f4b7a16056a1690e5f99b23ed86ec14e1bf895077a26db949d05d27316b00cf5bfe65f32bdb892f3467cd643421d1d0fb1b5906d84fa48d18d2b38b
- MD5 SHA1 SHA512