Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-01-2024 17:19
Behavioral task
behavioral1
Sample
38312527c8f936445c85e7ddde36f420.exe
Resource
win7-20231215-en
General
-
Target
38312527c8f936445c85e7ddde36f420.exe
-
Size
73KB
-
MD5
38312527c8f936445c85e7ddde36f420
-
SHA1
725a7f7522e907878eb84456ccb0424332b5cdd6
-
SHA256
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
-
SHA512
b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
SSDEEP
1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbCeZkwzUIbVclN:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwh6
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Exodus
91.92.255.187:4449
ypyertvpyqfr
-
delay
1
-
install
true
-
install_file
chromeupdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x0000000000EB0000-0x0000000000EC8000-memory.dmp asyncrat behavioral1/memory/2920-19-0x0000000000B80000-0x0000000000B98000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\chromeupdate.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
chromeupdate.exepid process 2920 chromeupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2760 timeout.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exechromeupdate.exepid process 2528 38312527c8f936445c85e7ddde36f420.exe 2528 38312527c8f936445c85e7ddde36f420.exe 2528 38312527c8f936445c85e7ddde36f420.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe 2920 chromeupdate.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exechromeupdate.exedescription pid process Token: SeDebugPrivilege 2528 38312527c8f936445c85e7ddde36f420.exe Token: SeDebugPrivilege 2920 chromeupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chromeupdate.exepid process 2920 chromeupdate.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.execmd.execmd.exedescription pid process target process PID 2528 wrote to memory of 1804 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2528 wrote to memory of 1804 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2528 wrote to memory of 1804 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2528 wrote to memory of 2808 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2528 wrote to memory of 2808 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2528 wrote to memory of 2808 2528 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 1804 wrote to memory of 2768 1804 cmd.exe schtasks.exe PID 1804 wrote to memory of 2768 1804 cmd.exe schtasks.exe PID 1804 wrote to memory of 2768 1804 cmd.exe schtasks.exe PID 2808 wrote to memory of 2760 2808 cmd.exe timeout.exe PID 2808 wrote to memory of 2760 2808 cmd.exe timeout.exe PID 2808 wrote to memory of 2760 2808 cmd.exe timeout.exe PID 2808 wrote to memory of 2920 2808 cmd.exe chromeupdate.exe PID 2808 wrote to memory of 2920 2808 cmd.exe chromeupdate.exe PID 2808 wrote to memory of 2920 2808 cmd.exe chromeupdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A54.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exe"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1A54.tmp.batFilesize
156B
MD5357d567e2d13cdefe84511a1872328c6
SHA1d512f14c59b564a92ebba5f563ebc42c9ed2b26e
SHA256c19b320c65a5a860d331af50fb5f22176008da1667c63b4749e0ce38f4a9d294
SHA5127b068fb37534d0fb46a14246a4efcdbe061364d17924bda875d84a64a8758d011f5f2e549975aa238142b7b2ad0a8190aa4be2a2d35e9be5d6571d23856f36be
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exeFilesize
73KB
MD538312527c8f936445c85e7ddde36f420
SHA1725a7f7522e907878eb84456ccb0424332b5cdd6
SHA2563df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
SHA512b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
memory/2528-1-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/2528-3-0x000000001AEA0000-0x000000001AF20000-memory.dmpFilesize
512KB
-
memory/2528-4-0x0000000076F70000-0x0000000077119000-memory.dmpFilesize
1.7MB
-
memory/2528-15-0x0000000076F70000-0x0000000077119000-memory.dmpFilesize
1.7MB
-
memory/2528-14-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/2528-0-0x0000000000EB0000-0x0000000000EC8000-memory.dmpFilesize
96KB
-
memory/2920-22-0x000000001ADE0000-0x000000001AE60000-memory.dmpFilesize
512KB
-
memory/2920-21-0x000007FEF4990000-0x000007FEF537C000-memory.dmpFilesize
9.9MB
-
memory/2920-19-0x0000000000B80000-0x0000000000B98000-memory.dmpFilesize
96KB
-
memory/2920-23-0x0000000076F70000-0x0000000077119000-memory.dmpFilesize
1.7MB
-
memory/2920-24-0x000007FEF4990000-0x000007FEF537C000-memory.dmpFilesize
9.9MB
-
memory/2920-25-0x000000001ADE0000-0x000000001AE60000-memory.dmpFilesize
512KB
-
memory/2920-26-0x0000000076F70000-0x0000000077119000-memory.dmpFilesize
1.7MB