Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 17:00
Static task
static1
Behavioral task
behavioral1
Sample
5178C3D5FB3E9A5CC0AA428226515BAC.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
5178C3D5FB3E9A5CC0AA428226515BAC.exe
Resource
win10v2004-20231127-en
General
-
Target
5178C3D5FB3E9A5CC0AA428226515BAC.exe
-
Size
1.4MB
-
MD5
5178c3d5fb3e9a5cc0aa428226515bac
-
SHA1
1ed781155e6ea6794657101797bf003381ca6d58
-
SHA256
b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
-
SHA512
f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
SSDEEP
24576:Ck+0wECvvv+p2zjNgK6dBiEcGwudooFkPhaFN0ACPyoI8IUGiKHT27znAzVbMg1G:JOWp2pkdooUEfCPkOGilzABQe
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
ronymahmoud.casacam.net:6606
ronymahmoud.casacam.net:7707
ronymahmoud.casacam.net:8808
imhydkyywihv
-
delay
9
-
install
true
-
install_file
explorrare.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3024-3-0x0000000000340000-0x0000000000352000-memory.dmp asyncrat behavioral1/memory/2592-20-0x0000000000470000-0x0000000000482000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
explorrare.exepid process 2592 explorrare.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2616 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2712 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.exepid process 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.exeexplorrare.exedescription pid process Token: SeDebugPrivilege 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe Token: SeDebugPrivilege 2592 explorrare.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.execmd.execmd.exedescription pid process target process PID 3024 wrote to memory of 2068 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2068 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2068 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2068 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2616 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2616 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2616 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 3024 wrote to memory of 2616 3024 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 2616 wrote to memory of 2712 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2712 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2712 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2712 2616 cmd.exe timeout.exe PID 2068 wrote to memory of 2908 2068 cmd.exe schtasks.exe PID 2068 wrote to memory of 2908 2068 cmd.exe schtasks.exe PID 2068 wrote to memory of 2908 2068 cmd.exe schtasks.exe PID 2068 wrote to memory of 2908 2068 cmd.exe schtasks.exe PID 2616 wrote to memory of 2592 2616 cmd.exe explorrare.exe PID 2616 wrote to memory of 2592 2616 cmd.exe explorrare.exe PID 2616 wrote to memory of 2592 2616 cmd.exe explorrare.exe PID 2616 wrote to memory of 2592 2616 cmd.exe explorrare.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5178C3D5FB3E9A5CC0AA428226515BAC.exe"C:\Users\Admin\AppData\Local\Temp\5178C3D5FB3E9A5CC0AA428226515BAC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 5178C3D5FB3E9A5CC0AA428226515BAC /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 5178C3D5FB3E9A5CC0AA428226515BAC /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"'3⤵
- Creates scheduled task(s)
PID:2908 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp646E.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2712 -
C:\Users\Admin\AppData\Roaming\explorrare.exe"C:\Users\Admin\AppData\Roaming\explorrare.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD5fa03554d057b66a2664986faaa63ae63
SHA14c473fae03306300db2472954fee5324537bd417
SHA25696adfaecad85fbd60fcd871959220cc593f6ca1023c8a4ce8cec373ac8b2cec5
SHA512b385a76b52119f4c6390a02063acee9a417806de2664ba1b6afb24e004b8164e10b10b8536ed58609062ed1a611d6333a566c46a2b661e8c3c51f33ba11ac44a
-
Filesize
154B
MD5fa03554d057b66a2664986faaa63ae63
SHA14c473fae03306300db2472954fee5324537bd417
SHA25696adfaecad85fbd60fcd871959220cc593f6ca1023c8a4ce8cec373ac8b2cec5
SHA512b385a76b52119f4c6390a02063acee9a417806de2664ba1b6afb24e004b8164e10b10b8536ed58609062ed1a611d6333a566c46a2b661e8c3c51f33ba11ac44a
-
Filesize
1.4MB
MD55178c3d5fb3e9a5cc0aa428226515bac
SHA11ed781155e6ea6794657101797bf003381ca6d58
SHA256b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
SHA512f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
Filesize
1.4MB
MD55178c3d5fb3e9a5cc0aa428226515bac
SHA11ed781155e6ea6794657101797bf003381ca6d58
SHA256b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
SHA512f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
Filesize
1.4MB
MD55178c3d5fb3e9a5cc0aa428226515bac
SHA11ed781155e6ea6794657101797bf003381ca6d58
SHA256b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
SHA512f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37