Analysis
-
max time kernel
122s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/03/2024, 18:31
Behavioral task
behavioral1
Sample
873D9DB7925A4EC75BFECF636D0EF454.exe
Resource
win7-20240221-en
General
-
Target
873D9DB7925A4EC75BFECF636D0EF454.exe
-
Size
69KB
-
MD5
873d9db7925a4ec75bfecf636d0ef454
-
SHA1
aa3f6724934db998d963cd18d2b358a62dfcdbbc
-
SHA256
689d3736122823defa550657e98157f7c57646369df7081cbc8efb245d8a0a06
-
SHA512
00570e3cab520d34db457b50a4f2be0604baa62e9f95a28d1d7e36127064954199c95ad90d9a49ec3e06db04a1b49c6e3cdeef2ddbc20b7be457edf313e3d616
-
SSDEEP
1536:2uwRszlg+JOyyJJ9OVnFbI7pTmZmCZseQvDjvaUH57:2uwRWO+JMOVnFbI7QICZRSaUZ7
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c0000000133d3-14.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2804 svhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2720 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2540 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 1920 873D9DB7925A4EC75BFECF636D0EF454.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1920 873D9DB7925A4EC75BFECF636D0EF454.exe Token: SeDebugPrivilege 2804 svhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2052 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 28 PID 1920 wrote to memory of 2052 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 28 PID 1920 wrote to memory of 2052 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 28 PID 1920 wrote to memory of 2052 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 28 PID 1920 wrote to memory of 2720 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 30 PID 1920 wrote to memory of 2720 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 30 PID 1920 wrote to memory of 2720 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 30 PID 1920 wrote to memory of 2720 1920 873D9DB7925A4EC75BFECF636D0EF454.exe 30 PID 2052 wrote to memory of 2532 2052 cmd.exe 32 PID 2052 wrote to memory of 2532 2052 cmd.exe 32 PID 2052 wrote to memory of 2532 2052 cmd.exe 32 PID 2052 wrote to memory of 2532 2052 cmd.exe 32 PID 2720 wrote to memory of 2540 2720 cmd.exe 33 PID 2720 wrote to memory of 2540 2720 cmd.exe 33 PID 2720 wrote to memory of 2540 2720 cmd.exe 33 PID 2720 wrote to memory of 2540 2720 cmd.exe 33 PID 2720 wrote to memory of 2804 2720 cmd.exe 34 PID 2720 wrote to memory of 2804 2720 cmd.exe 34 PID 2720 wrote to memory of 2804 2720 cmd.exe 34 PID 2720 wrote to memory of 2804 2720 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\873D9DB7925A4EC75BFECF636D0EF454.exe"C:\Users\Admin\AppData\Local\Temp\873D9DB7925A4EC75BFECF636D0EF454.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'3⤵
- Creates scheduled task(s)
PID:2532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5D7.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2540
-
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD5956d5b8c0359c39874ed5c93efe4b93b
SHA10489f7b5eb5a1a4008bce825fbed183760c86537
SHA256dad2fdbe55a92859a7841f23752193e45ce1295aa130f1eaf44e3c7e27cc2cf3
SHA51208b746b705aeb3f48e6c17ce26478d2227514965210a7e1710f2529740ef4ef5d07f3a1044275363418042884838e8fdd41183dd4bcb717028f7a1c5fef3b691
-
Filesize
69KB
MD5873d9db7925a4ec75bfecf636d0ef454
SHA1aa3f6724934db998d963cd18d2b358a62dfcdbbc
SHA256689d3736122823defa550657e98157f7c57646369df7081cbc8efb245d8a0a06
SHA51200570e3cab520d34db457b50a4f2be0604baa62e9f95a28d1d7e36127064954199c95ad90d9a49ec3e06db04a1b49c6e3cdeef2ddbc20b7be457edf313e3d616