Analysis
-
max time kernel
19s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 17:19
Behavioral task
behavioral1
Sample
38312527c8f936445c85e7ddde36f420.exe
Resource
win7-20231215-en
General
-
Target
38312527c8f936445c85e7ddde36f420.exe
-
Size
73KB
-
MD5
38312527c8f936445c85e7ddde36f420
-
SHA1
725a7f7522e907878eb84456ccb0424332b5cdd6
-
SHA256
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
-
SHA512
b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
SSDEEP
1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbCeZkwzUIbVclN:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwh6
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Exodus
91.92.255.187:4449
ypyertvpyqfr
-
delay
1
-
install
true
-
install_file
chromeupdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1380-0-0x0000000000700000-0x0000000000718000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\chromeupdate.exe asyncrat C:\Users\Admin\AppData\Roaming\chromeupdate.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
38312527c8f936445c85e7ddde36f420.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 38312527c8f936445c85e7ddde36f420.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4192 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exepid process 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe 1380 38312527c8f936445c85e7ddde36f420.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exedescription pid process Token: SeDebugPrivilege 1380 38312527c8f936445c85e7ddde36f420.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exedescription pid process target process PID 1380 wrote to memory of 4908 1380 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 1380 wrote to memory of 4908 1380 38312527c8f936445c85e7ddde36f420.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE7B0.tmp.bat""2⤵
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exe"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE7B0.tmp.batFilesize
156B
MD556484193b8f072efd1d71f820f5802b6
SHA1c8c8e4ff5e76539a95c7c40e168906b6d7c1e388
SHA2566104c7dc4e2ab604179b891c90eb15f45b7252c5c9d05d177b4acda257495fe3
SHA5126ed45a87243da0b404166e7f8657725808258dc97f898fad08f965498f7b8653fd71f4a42d27c855a04947d8a0bd966d670b805546ac094bba8dd3b2a8d154fd
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exeFilesize
47KB
MD53bb8f0a26cf28d72718f20fcb5c618ce
SHA18369df08482d67829a19abfc84afa8f4a4c866cc
SHA25679e24e7914e3a2d06eec90c22dece6e3f5b3d91596af92fc3318c340ffdd7083
SHA51223f9f27921e2fa08dd88c9f91554727e6da44f7034c5ca9f3a9a7b39aaf7e8f101254480a1cb8e9059b8fdb3ee636890ded6a71c3cb31f1e3c936c71f17e0e14
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exeFilesize
1KB
MD51571c876dea6e74eb92def9a411e8f02
SHA17185c93479187ace7756f02ceb84a26e235b2e5a
SHA256b521fe3a02613c320f9444238fe0f9e4241b0378f1421f2106589fc91d8901a1
SHA5121688ec2dedc94ab6b4379e50f7101474a71258c6c523fe61fb2610e5073b0e85bdfc02ad7243559ae4bdd86abf0c74c4a86af45c85f57dee856b7fb2fe1e9ec3
-
memory/1380-6-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/1380-10-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/1380-9-0x00007FF9616D0000-0x00007FF962191000-memory.dmpFilesize
10.8MB
-
memory/1380-0-0x0000000000700000-0x0000000000718000-memory.dmpFilesize
96KB
-
memory/1380-2-0x00007FF9616D0000-0x00007FF962191000-memory.dmpFilesize
10.8MB
-
memory/1380-3-0x0000000001020000-0x0000000001030000-memory.dmpFilesize
64KB
-
memory/2844-17-0x000000001BA90000-0x000000001BAA0000-memory.dmpFilesize
64KB
-
memory/2844-16-0x00007FF960A60000-0x00007FF961521000-memory.dmpFilesize
10.8MB
-
memory/2844-18-0x00007FF960A60000-0x00007FF961521000-memory.dmpFilesize
10.8MB
-
memory/2844-19-0x000000001BA90000-0x000000001BAA0000-memory.dmpFilesize
64KB