Analysis
-
max time kernel
139s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2024, 18:31
Behavioral task
behavioral1
Sample
873D9DB7925A4EC75BFECF636D0EF454.exe
Resource
win7-20240221-en
General
-
Target
873D9DB7925A4EC75BFECF636D0EF454.exe
-
Size
69KB
-
MD5
873d9db7925a4ec75bfecf636d0ef454
-
SHA1
aa3f6724934db998d963cd18d2b358a62dfcdbbc
-
SHA256
689d3736122823defa550657e98157f7c57646369df7081cbc8efb245d8a0a06
-
SHA512
00570e3cab520d34db457b50a4f2be0604baa62e9f95a28d1d7e36127064954199c95ad90d9a49ec3e06db04a1b49c6e3cdeef2ddbc20b7be457edf313e3d616
-
SSDEEP
1536:2uwRszlg+JOyyJJ9OVnFbI7pTmZmCZseQvDjvaUH57:2uwRWO+JMOVnFbI7QICZRSaUZ7
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023205-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 873D9DB7925A4EC75BFECF636D0EF454.exe -
Executes dropped EXE 1 IoCs
pid Process 864 svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 628 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4140 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe 460 873D9DB7925A4EC75BFECF636D0EF454.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 460 873D9DB7925A4EC75BFECF636D0EF454.exe Token: SeDebugPrivilege 864 svhost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 460 wrote to memory of 3312 460 873D9DB7925A4EC75BFECF636D0EF454.exe 90 PID 460 wrote to memory of 3312 460 873D9DB7925A4EC75BFECF636D0EF454.exe 90 PID 460 wrote to memory of 3312 460 873D9DB7925A4EC75BFECF636D0EF454.exe 90 PID 460 wrote to memory of 4560 460 873D9DB7925A4EC75BFECF636D0EF454.exe 92 PID 460 wrote to memory of 4560 460 873D9DB7925A4EC75BFECF636D0EF454.exe 92 PID 460 wrote to memory of 4560 460 873D9DB7925A4EC75BFECF636D0EF454.exe 92 PID 3312 wrote to memory of 628 3312 cmd.exe 94 PID 3312 wrote to memory of 628 3312 cmd.exe 94 PID 3312 wrote to memory of 628 3312 cmd.exe 94 PID 4560 wrote to memory of 4140 4560 cmd.exe 95 PID 4560 wrote to memory of 4140 4560 cmd.exe 95 PID 4560 wrote to memory of 4140 4560 cmd.exe 95 PID 4560 wrote to memory of 864 4560 cmd.exe 96 PID 4560 wrote to memory of 864 4560 cmd.exe 96 PID 4560 wrote to memory of 864 4560 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\873D9DB7925A4EC75BFECF636D0EF454.exe"C:\Users\Admin\AppData\Local\Temp\873D9DB7925A4EC75BFECF636D0EF454.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'3⤵
- Creates scheduled task(s)
PID:628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC043.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4140
-
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD59ad37ebb44ffbb56c01934fbfebd073b
SHA1e895a634c897ace6cd5d8f1315a2ea2bbb98ff32
SHA256630644ad287fc01e4d432b7b379aefc9f90da37c7b3bb10a8eb7e3f99913f970
SHA5124cbaaaa9615d66a0e1bd936fb67d19b6e376d82e4962a4a04c4363a9d0435324015aff252c1bc30cbd464cff25c2d7b64711dea835a23110f68b1318096d3938
-
Filesize
69KB
MD5873d9db7925a4ec75bfecf636d0ef454
SHA1aa3f6724934db998d963cd18d2b358a62dfcdbbc
SHA256689d3736122823defa550657e98157f7c57646369df7081cbc8efb245d8a0a06
SHA51200570e3cab520d34db457b50a4f2be0604baa62e9f95a28d1d7e36127064954199c95ad90d9a49ec3e06db04a1b49c6e3cdeef2ddbc20b7be457edf313e3d616