Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 17:11
Static task
static1
Behavioral task
behavioral1
Sample
5178C3D5FB3E9A5CC0AA428226515BAC.exe
Resource
win7-20231023-en
General
-
Target
5178C3D5FB3E9A5CC0AA428226515BAC.exe
-
Size
1.4MB
-
MD5
5178c3d5fb3e9a5cc0aa428226515bac
-
SHA1
1ed781155e6ea6794657101797bf003381ca6d58
-
SHA256
b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
-
SHA512
f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
SSDEEP
24576:Ck+0wECvvv+p2zjNgK6dBiEcGwudooFkPhaFN0ACPyoI8IUGiKHT27znAzVbMg1G:JOWp2pkdooUEfCPkOGilzABQe
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
ronymahmoud.casacam.net:6606
ronymahmoud.casacam.net:7707
ronymahmoud.casacam.net:8808
imhydkyywihv
-
delay
9
-
install
true
-
install_file
explorrare.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/800-6-0x00000000052F0000-0x0000000005302000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation 5178C3D5FB3E9A5CC0AA428226515BAC.exe -
Executes dropped EXE 1 IoCs
Processes:
explorrare.exepid process 2884 explorrare.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 384 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.exepid process 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.exeexplorrare.exedescription pid process Token: SeDebugPrivilege 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe Token: SeDebugPrivilege 2884 explorrare.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5178C3D5FB3E9A5CC0AA428226515BAC.execmd.execmd.exedescription pid process target process PID 800 wrote to memory of 2756 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 800 wrote to memory of 2756 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 800 wrote to memory of 2756 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 800 wrote to memory of 2520 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 800 wrote to memory of 2520 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 800 wrote to memory of 2520 800 5178C3D5FB3E9A5CC0AA428226515BAC.exe cmd.exe PID 2756 wrote to memory of 4012 2756 cmd.exe schtasks.exe PID 2756 wrote to memory of 4012 2756 cmd.exe schtasks.exe PID 2756 wrote to memory of 4012 2756 cmd.exe schtasks.exe PID 2520 wrote to memory of 384 2520 cmd.exe timeout.exe PID 2520 wrote to memory of 384 2520 cmd.exe timeout.exe PID 2520 wrote to memory of 384 2520 cmd.exe timeout.exe PID 2520 wrote to memory of 2884 2520 cmd.exe explorrare.exe PID 2520 wrote to memory of 2884 2520 cmd.exe explorrare.exe PID 2520 wrote to memory of 2884 2520 cmd.exe explorrare.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5178C3D5FB3E9A5CC0AA428226515BAC.exe"C:\Users\Admin\AppData\Local\Temp\5178C3D5FB3E9A5CC0AA428226515BAC.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 5178C3D5FB3E9A5CC0AA428226515BAC /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 5178C3D5FB3E9A5CC0AA428226515BAC /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF155.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorrare.exe"C:\Users\Admin\AppData\Roaming\explorrare.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF155.tmp.batFilesize
154B
MD5ad174e55eab6c5dfc931596a7cb122d1
SHA197ff2ff55140d003713a82cd8bb09987bc24abda
SHA256476da8e29bffcfffadfba28daff47130d307d3481fd5596200358feb3827f444
SHA5127d19347446392957fa9cafe22f53376129b4829a9d227756f410e00332dbd0cf16a3f17d8fdca3432e8ce4d0bdd1ad29c0d3e339bf86f57d0140423e69f66ffb
-
C:\Users\Admin\AppData\Roaming\explorrare.exeFilesize
1.4MB
MD55178c3d5fb3e9a5cc0aa428226515bac
SHA11ed781155e6ea6794657101797bf003381ca6d58
SHA256b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
SHA512f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
C:\Users\Admin\AppData\Roaming\explorrare.exeFilesize
1.4MB
MD55178c3d5fb3e9a5cc0aa428226515bac
SHA11ed781155e6ea6794657101797bf003381ca6d58
SHA256b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
SHA512f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
memory/800-4-0x00000000054C0000-0x000000000555C000-memory.dmpFilesize
624KB
-
memory/800-2-0x00000000059D0000-0x0000000005F74000-memory.dmpFilesize
5.6MB
-
memory/800-5-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/800-6-0x00000000052F0000-0x0000000005302000-memory.dmpFilesize
72KB
-
memory/800-7-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/800-3-0x0000000005420000-0x00000000054B2000-memory.dmpFilesize
584KB
-
memory/800-13-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/800-0-0x0000000000820000-0x000000000098A000-memory.dmpFilesize
1.4MB
-
memory/800-1-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/2884-17-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/2884-18-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/2884-19-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/2884-22-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/2884-23-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB