Analysis
- max time kernel
142s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
07/07/2023, 13:55
Behavioral task
behavioral1
Sample
decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
Resource
win7-20230703-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe
- Size 47KB
- Sample230707-q74hdsaf4v
- SHA256 76ded83d3b20de4cab65576d0e4c5adcd5b8ebb76e064ef4c2d3449ebdd25cac
- MD5 86c1fef12c75d7765f96defa9c7f58f3
- SHA1 304c6a7fbe66e820d4aa5f2132f3b3c2179ab080
- SHA512 4be07c224b4b856aa09ae12911bd7f7c2869c83649bdc5d13c3bbd9d797736ff4ab558ea33ef9b22c086551a99420a8d1cd1a6ec08b8e01f421405142bd3c129
- SSDEEP 768:JOEuILWCKi+DiVWD+RPpiDy8Yb7geEwjxU3OlojvEgK/JjZVc6KN:JOtmVWCR3zbEZw+38ojnkJjZVclN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
6JULIO-PJOAOJS
C2
-
20.200.63.2:2727
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2736-133-0x0000000000FA0000-0x0000000000FB2000-memory.dmp asyncrat - Renames multiple (385) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ky.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\NOTICE decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jaas_nt.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\JAWTAccessBridge-64.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jli.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javafx_font_t2k.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ja_JP.jar decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\LICENSE decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\System\wab32.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1568 timeout.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3140 2736 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe 87 PID 2736 wrote to memory of 3140 2736 decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe 87 PID 3140 wrote to memory of 1568 3140 cmd.exe 89 PID 3140 wrote to memory of 1568 3140 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe"C:\Users\Admin\AppData\Local\Temp\decode_1547e0b0ed6a633c62a145f1d9d606c5a7fae8cbbdc5ce73165804f78eff335f.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9769.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1568
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl
- Size 5KB
- SHA256 7a808f42100ece1de2b2990b3e0c7e79103bef8100a23194aa379c814bfbd910
- MD5 156e230f7982f4bef7c9693923c04866
- SHA1 5211a21b9866bc250e829e3d85ba57d92de5bb5f
- SHA512 7836b9739548c52aeca99e2f07ed9c2d4c5e9955654d96ae5932ea077ab81e21623218440e848d03c783c61c036cefe4821052f32501e548b59a7758b1eed15a
- SSDEEP 96:7OGOMYq+qwwAj5lyuw5IaOFcEAWpzlXGLOU23PS39b9Hl/penFnaVctnXcPa4DRe:6GlwXauSIJ5ZlXGU3qfHlPVctnf4V0eo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp9769.tmp.bat
- Size 223B
- SHA256 79064ce8ab43489283d361988afc0e822f760c08b5f8b4d54db6d4eaa2d5cc3c
- MD5 50d08abb890ec805840955dd91387a97
- SHA1 1fd166feb9893e8146e1a4bcd08e09ce9000ff25
- SHA512 98cf271a4b3ef73b29242f14cf0bea7a167b2592ab25d8126c97f856684ae3db871c55644af8bc5acdf7bedb9af89afb014ccf299fb4a7b80029c87ec6cba64a
- MD5 SHA1 SHA512