Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 04:08
Behavioral task
behavioral1
Sample
6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe
Resource
win7-20231215-en
General
-
Target
6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe
-
Size
63KB
-
MD5
e40435c6df1a16aad70fcb8582228bc3
-
SHA1
8d5a1a1213b6680cfe3cb59aa0383ae8a91d5141
-
SHA256
6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd
-
SHA512
f7e33a06735e0297c06d3875010bc065471ce44ff86466cdf36c7773f4c3b1e9aef96c00efbf162976f695e50f06e7729f995a63a9de6335e0dcb36e7a19da2b
-
SSDEEP
1536:UJ/t/dSJYUbdh9IM1b+uFg6CinpqKmY7:U3/YYUbd3Zg6Ci0z
Malware Config
Extracted
asyncrat
Default
127.0.0.1:3232
吾吾owlΒiH1XNبmש吉E迪yاqCX
-
delay
1
-
install
true
-
install_file
GoogleChromeUpd.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4796-0-0x0000000000F10000-0x0000000000F26000-memory.dmp asyncrat behavioral2/files/0x0009000000022480-13.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe -
Executes dropped EXE 1 IoCs
pid Process 2252 GoogleChromeUpd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5044 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2224 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe 2252 GoogleChromeUpd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe Token: SeDebugPrivilege 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe Token: SeDebugPrivilege 2252 GoogleChromeUpd.exe Token: SeDebugPrivilege 2252 GoogleChromeUpd.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4340 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 89 PID 4796 wrote to memory of 4340 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 89 PID 4796 wrote to memory of 3440 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 91 PID 4796 wrote to memory of 3440 4796 6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe 91 PID 3440 wrote to memory of 2224 3440 cmd.exe 94 PID 3440 wrote to memory of 2224 3440 cmd.exe 94 PID 4340 wrote to memory of 5044 4340 cmd.exe 93 PID 4340 wrote to memory of 5044 4340 cmd.exe 93 PID 3440 wrote to memory of 2252 3440 cmd.exe 95 PID 3440 wrote to memory of 2252 3440 cmd.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe"C:\Users\Admin\AppData\Local\Temp\6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleChromeUpd" /tr '"C:\Users\Admin\AppData\Roaming\GoogleChromeUpd.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "GoogleChromeUpd" /tr '"C:\Users\Admin\AppData\Roaming\GoogleChromeUpd.exe"'3⤵
- Creates scheduled task(s)
PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD90A.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2224
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpd.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpd.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159B
MD5747147bdb4b7059985a6cbae14e3a833
SHA106afb54f8627f26b7570c97afd25bee2a1ec2b87
SHA2565764554e82684799b1610fabc7043edf89345dc67219093e86a68d05d962ce76
SHA512f9012a503ce0d170a24209ae62c4fb695fba69e4f04e7241b89e9c49668ad4ea6c97d6838581d083abca95acae277c5bfc3b8dd35b526757ba0cbabf54e11320
-
Filesize
63KB
MD5e40435c6df1a16aad70fcb8582228bc3
SHA18d5a1a1213b6680cfe3cb59aa0383ae8a91d5141
SHA2566148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd
SHA512f7e33a06735e0297c06d3875010bc065471ce44ff86466cdf36c7773f4c3b1e9aef96c00efbf162976f695e50f06e7729f995a63a9de6335e0dcb36e7a19da2b