Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 17:16
Behavioral task
behavioral1
Sample
1680-3-0x0000000000510000-0x0000000000522000-memory.exe
Resource
win7-20231129-en
General
-
Target
1680-3-0x0000000000510000-0x0000000000522000-memory.exe
-
Size
72KB
-
MD5
0760ccf06513794ba0a457234bd63529
-
SHA1
362a9b3eadf2746b7b63d4b1159107e15a08ef5d
-
SHA256
a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed
-
SHA512
d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6
-
SSDEEP
768:Qov5MNNmnO4Gl2CN8wG8yU5CFbjbRgr3iEZ9PKAClZN2tYcFmVc6K:Qov5MNQDXUEPberSQWrNKmVcl
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
ronymahmoud.casacam.net:6606
ronymahmoud.casacam.net:7707
ronymahmoud.casacam.net:8808
imhydkyywihv
-
delay
9
-
install
true
-
install_file
explorrare.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2864-0-0x0000000000900000-0x0000000000912000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorrare.exe asyncrat C:\Users\Admin\AppData\Roaming\explorrare.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1680-3-0x0000000000510000-0x0000000000522000-memory.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\Control Panel\International\Geo\Nation 1680-3-0x0000000000510000-0x0000000000522000-memory.exe -
Executes dropped EXE 1 IoCs
Processes:
explorrare.exepid process 4508 explorrare.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4080 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
1680-3-0x0000000000510000-0x0000000000522000-memory.exepid process 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1680-3-0x0000000000510000-0x0000000000522000-memory.exeexplorrare.exedescription pid process Token: SeDebugPrivilege 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe Token: SeDebugPrivilege 4508 explorrare.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1680-3-0x0000000000510000-0x0000000000522000-memory.execmd.execmd.exedescription pid process target process PID 2864 wrote to memory of 4568 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe cmd.exe PID 2864 wrote to memory of 4568 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe cmd.exe PID 2864 wrote to memory of 3680 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe cmd.exe PID 2864 wrote to memory of 3680 2864 1680-3-0x0000000000510000-0x0000000000522000-memory.exe cmd.exe PID 4568 wrote to memory of 1860 4568 cmd.exe schtasks.exe PID 4568 wrote to memory of 1860 4568 cmd.exe schtasks.exe PID 3680 wrote to memory of 4080 3680 cmd.exe timeout.exe PID 3680 wrote to memory of 4080 3680 cmd.exe timeout.exe PID 3680 wrote to memory of 4508 3680 cmd.exe explorrare.exe PID 3680 wrote to memory of 4508 3680 cmd.exe explorrare.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1680-3-0x0000000000510000-0x0000000000522000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1680-3-0x0000000000510000-0x0000000000522000-memory.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1680-3-0x0000000000510000-0x0000000000522000-memory /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 1680-3-0x0000000000510000-0x0000000000522000-memory /tr '"C:\Users\Admin\AppData\Roaming\explorrare.exe"'3⤵
- Creates scheduled task(s)
PID:1860 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6D6F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4080 -
C:\Users\Admin\AppData\Roaming\explorrare.exe"C:\Users\Admin\AppData\Roaming\explorrare.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD549659d1a0428f8bb763858d5b35bfe37
SHA1f8a7b103a691111dd4f2e99c2f11810eba78a458
SHA256b7ab91accd9ea28442bfffe026f72483664c50a54741984bd2abea4bb24bee54
SHA5121734a039140db9df265392d6a2e927a50823b1263cc18816d60b5cdacec2a1ac8e2da8f3f7c83d6ffb7c11162d74bd4d7358c4cff2f42abdbddb2968a3758916
-
Filesize
72KB
MD50760ccf06513794ba0a457234bd63529
SHA1362a9b3eadf2746b7b63d4b1159107e15a08ef5d
SHA256a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed
SHA512d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6
-
Filesize
72KB
MD50760ccf06513794ba0a457234bd63529
SHA1362a9b3eadf2746b7b63d4b1159107e15a08ef5d
SHA256a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed
SHA512d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6