Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-01-2024 17:18
Behavioral task
behavioral1
Sample
38312527c8f936445c85e7ddde36f420.exe
Resource
win7-20231129-en
General
-
Target
38312527c8f936445c85e7ddde36f420.exe
-
Size
73KB
-
MD5
38312527c8f936445c85e7ddde36f420
-
SHA1
725a7f7522e907878eb84456ccb0424332b5cdd6
-
SHA256
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
-
SHA512
b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
SSDEEP
1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbCeZkwzUIbVclN:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwh6
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Exodus
91.92.255.187:4449
ypyertvpyqfr
-
delay
1
-
install
true
-
install_file
chromeupdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2912-0-0x00000000012E0000-0x00000000012F8000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\chromeupdate.exe asyncrat behavioral1/memory/2876-19-0x0000000000D60000-0x0000000000D78000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
chromeupdate.exepid process 2876 chromeupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2648 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exechromeupdate.exepid process 2912 38312527c8f936445c85e7ddde36f420.exe 2912 38312527c8f936445c85e7ddde36f420.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe 2876 chromeupdate.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.exechromeupdate.exedescription pid process Token: SeDebugPrivilege 2912 38312527c8f936445c85e7ddde36f420.exe Token: SeDebugPrivilege 2876 chromeupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chromeupdate.exepid process 2876 chromeupdate.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
38312527c8f936445c85e7ddde36f420.execmd.execmd.exedescription pid process target process PID 2912 wrote to memory of 2788 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2912 wrote to memory of 2788 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2912 wrote to memory of 2788 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2912 wrote to memory of 2152 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2912 wrote to memory of 2152 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2912 wrote to memory of 2152 2912 38312527c8f936445c85e7ddde36f420.exe cmd.exe PID 2788 wrote to memory of 2564 2788 cmd.exe schtasks.exe PID 2788 wrote to memory of 2564 2788 cmd.exe schtasks.exe PID 2788 wrote to memory of 2564 2788 cmd.exe schtasks.exe PID 2152 wrote to memory of 2648 2152 cmd.exe timeout.exe PID 2152 wrote to memory of 2648 2152 cmd.exe timeout.exe PID 2152 wrote to memory of 2648 2152 cmd.exe timeout.exe PID 2152 wrote to memory of 2876 2152 cmd.exe chromeupdate.exe PID 2152 wrote to memory of 2876 2152 cmd.exe chromeupdate.exe PID 2152 wrote to memory of 2876 2152 cmd.exe chromeupdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"C:\Users\Admin\AppData\Local\Temp\38312527c8f936445c85e7ddde36f420.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC8E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exe"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC8E.tmp.batFilesize
155B
MD5802081364545bb3264f5b5da5e1374c7
SHA164d9a4753f26129afb1fa90ec641db19259f1976
SHA25657c68210d50c367ca5d42619493f6654f7c34947941ee391e044284ba202261a
SHA5125dd2a6c89a64809d25eb567d071796041c09890d01a659214dfdb0f982d05adcc183a6fef07f75805be4875a1caa21ecf09e355200a5d173385b5ab6a7a60c1e
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exeFilesize
73KB
MD538312527c8f936445c85e7ddde36f420
SHA1725a7f7522e907878eb84456ccb0424332b5cdd6
SHA2563df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
SHA512b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
memory/2876-19-0x0000000000D60000-0x0000000000D78000-memory.dmpFilesize
96KB
-
memory/2876-21-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmpFilesize
9.9MB
-
memory/2876-22-0x000000001ADE0000-0x000000001AE60000-memory.dmpFilesize
512KB
-
memory/2876-23-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/2876-24-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmpFilesize
9.9MB
-
memory/2876-25-0x000000001ADE0000-0x000000001AE60000-memory.dmpFilesize
512KB
-
memory/2876-26-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/2912-4-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/2912-14-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmpFilesize
9.9MB
-
memory/2912-15-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/2912-3-0x000000001AF10000-0x000000001AF90000-memory.dmpFilesize
512KB
-
memory/2912-0-0x00000000012E0000-0x00000000012F8000-memory.dmpFilesize
96KB
-
memory/2912-2-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmpFilesize
9.9MB