Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14-01-2024 01:16
Behavioral task
behavioral1
Sample
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe
Resource
win7-20231129-en
General
-
Target
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe
-
Size
73KB
-
MD5
38312527c8f936445c85e7ddde36f420
-
SHA1
725a7f7522e907878eb84456ccb0424332b5cdd6
-
SHA256
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
-
SHA512
b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
SSDEEP
1536:6aUqAcxVMW7eTmJ9rxjJTkdK4WaxHdSzPMwy/eqmmRhdWVH1bfbCeZkwzUIbVclN:6aUTcxVMW7eiJ9rxjJTkdK4WaP0PMwh6
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Exodus
91.92.255.187:4449
ypyertvpyqfr
-
delay
1
-
install
true
-
install_file
chromeupdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2888-0-0x00000000009B0000-0x00000000009C8000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\chromeupdate.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe -
Executes dropped EXE 1 IoCs
Processes:
chromeupdate.exepid process 4800 chromeupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4004 timeout.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exechromeupdate.exepid process 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe 4800 chromeupdate.exe 4800 chromeupdate.exe 4800 chromeupdate.exe 4800 chromeupdate.exe 4800 chromeupdate.exe 4800 chromeupdate.exe 4800 chromeupdate.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exechromeupdate.exedescription pid process Token: SeDebugPrivilege 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe Token: SeDebugPrivilege 4800 chromeupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chromeupdate.exepid process 4800 chromeupdate.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.execmd.execmd.exedescription pid process target process PID 2888 wrote to memory of 2368 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe cmd.exe PID 2888 wrote to memory of 2368 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe cmd.exe PID 2888 wrote to memory of 2436 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe cmd.exe PID 2888 wrote to memory of 2436 2888 3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe cmd.exe PID 2368 wrote to memory of 4500 2368 cmd.exe schtasks.exe PID 2368 wrote to memory of 4500 2368 cmd.exe schtasks.exe PID 2436 wrote to memory of 4004 2436 cmd.exe timeout.exe PID 2436 wrote to memory of 4004 2436 cmd.exe timeout.exe PID 2436 wrote to memory of 4800 2436 cmd.exe chromeupdate.exe PID 2436 wrote to memory of 4800 2436 cmd.exe chromeupdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe"C:\Users\Admin\AppData\Local\Temp\3df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp444C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exe"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp444C.tmp.batFilesize
156B
MD53b29e8f2e6d016c9d69d5ec8409fc917
SHA1725e45700c146a76081901e2e7ab5e164bf9302f
SHA256d82e5eef1c94bd37a8352f184a06348c56d1642a8c0f75a55fc18015145144a8
SHA5125818fe369c5504b5e5132936a9c196100cd7a5f0bc06851fcb9b4b421727b65f8f7a77fe4b77ea7120cf2c51b484d12185c0774ba379fac85c19cf0f61615dcf
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exeFilesize
73KB
MD538312527c8f936445c85e7ddde36f420
SHA1725a7f7522e907878eb84456ccb0424332b5cdd6
SHA2563df5b2d8fa12771d01180865d86b83385535794b18232cca17e5a7e3fac585fb
SHA512b748a3c76aaeefe29ca856ebbe49b7e316c992af399e6678bb43e0bef297e03cf0144b06cad64a9c46c6a2950e38036a07bd9e3dc23cc67f1b63702153fc38d0
-
memory/2888-0-0x00000000009B0000-0x00000000009C8000-memory.dmpFilesize
96KB
-
memory/2888-2-0x00007FFD831E0000-0x00007FFD83CA1000-memory.dmpFilesize
10.8MB
-
memory/2888-3-0x000000001B680000-0x000000001B690000-memory.dmpFilesize
64KB
-
memory/2888-10-0x00007FFD831E0000-0x00007FFD83CA1000-memory.dmpFilesize
10.8MB
-
memory/2888-8-0x00007FFDA1450000-0x00007FFDA1645000-memory.dmpFilesize
2.0MB
-
memory/4800-15-0x00007FFD82BA0000-0x00007FFD83661000-memory.dmpFilesize
10.8MB
-
memory/4800-16-0x0000000002DF0000-0x0000000002E00000-memory.dmpFilesize
64KB
-
memory/4800-17-0x00007FFD82BA0000-0x00007FFD83661000-memory.dmpFilesize
10.8MB
-
memory/4800-18-0x0000000002DF0000-0x0000000002E00000-memory.dmpFilesize
64KB