Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 23:48
Behavioral task
behavioral1
Sample
SeroXen.exe
Resource
win7-20240221-en
General
-
Target
SeroXen.exe
-
Size
158KB
-
MD5
9fbd542a485a60bc5f9dd053c6917b3c
-
SHA1
b02791c1f6d06133b91f047c5131469502247924
-
SHA256
e17aa5e68d9acc532fc49febca4c7072496df5e47183e3d10d8f89b31c160cf5
-
SHA512
f51e3fd84a3d0d059777fcf44a6154a33b6eee94c40065d5cf454a3489230c1daf4ed3c65f134f3ebcf1c024d485c4a270041567932fc9d06d1998a6298a5b3b
-
SSDEEP
3072:YuGkTQaI2ObNc3RnbzgF50mmEuxnetCje3ew33Wv1x:YuGixl3RnbcH0cuxetC+33Wvz
Malware Config
Extracted
asyncrat
0.5.8
Async
140.238.91.110:42341
GW7yTStHluEa
-
delay
3
-
install
true
-
install_file
WindowsUpdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SeroXen.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SeroXen.exe -
Executes dropped EXE 1 IoCs
Processes:
WindowsUpdate.exepid process 2276 WindowsUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1016 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
SeroXen.exepid process 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe 3664 SeroXen.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SeroXen.exeWindowsUpdate.exedescription pid process Token: SeDebugPrivilege 3664 SeroXen.exe Token: SeDebugPrivilege 2276 WindowsUpdate.exe Token: SeDebugPrivilege 2276 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SeroXen.execmd.execmd.exedescription pid process target process PID 3664 wrote to memory of 700 3664 SeroXen.exe cmd.exe PID 3664 wrote to memory of 700 3664 SeroXen.exe cmd.exe PID 3664 wrote to memory of 700 3664 SeroXen.exe cmd.exe PID 3664 wrote to memory of 4872 3664 SeroXen.exe cmd.exe PID 3664 wrote to memory of 4872 3664 SeroXen.exe cmd.exe PID 3664 wrote to memory of 4872 3664 SeroXen.exe cmd.exe PID 700 wrote to memory of 504 700 cmd.exe schtasks.exe PID 700 wrote to memory of 504 700 cmd.exe schtasks.exe PID 700 wrote to memory of 504 700 cmd.exe schtasks.exe PID 4872 wrote to memory of 1016 4872 cmd.exe timeout.exe PID 4872 wrote to memory of 1016 4872 cmd.exe timeout.exe PID 4872 wrote to memory of 1016 4872 cmd.exe timeout.exe PID 4872 wrote to memory of 2276 4872 cmd.exe WindowsUpdate.exe PID 4872 wrote to memory of 2276 4872 cmd.exe WindowsUpdate.exe PID 4872 wrote to memory of 2276 4872 cmd.exe WindowsUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"'3⤵
- Creates scheduled task(s)
PID:504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C4D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1016 -
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4828 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:4816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1C4D.tmp.batFilesize
157B
MD5d37b19a5d760582a267312a8d3db14d9
SHA1566f284300b90a23363570ca826403d2647419f0
SHA2565da4ba5eeaad5e9ba5c648b9f6e83f55e71f038de8cf1b15768815d80b1adf93
SHA512dce78a8b17a811554880a273e7aa19e228696b47ac1273f4965516174d2619166c18f267d25e348b2f69cde22f2d3ae415445fc01b9636866f967b74529a1de7
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exeFilesize
158KB
MD59fbd542a485a60bc5f9dd053c6917b3c
SHA1b02791c1f6d06133b91f047c5131469502247924
SHA256e17aa5e68d9acc532fc49febca4c7072496df5e47183e3d10d8f89b31c160cf5
SHA512f51e3fd84a3d0d059777fcf44a6154a33b6eee94c40065d5cf454a3489230c1daf4ed3c65f134f3ebcf1c024d485c4a270041567932fc9d06d1998a6298a5b3b
-
memory/2276-14-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/2276-15-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/2276-16-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/2276-17-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/3664-0-0x00000000749B0000-0x0000000075160000-memory.dmpFilesize
7.7MB
-
memory/3664-1-0x0000000000270000-0x000000000029E000-memory.dmpFilesize
184KB
-
memory/3664-2-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/3664-3-0x0000000004D80000-0x0000000004DE6000-memory.dmpFilesize
408KB
-
memory/3664-4-0x00000000051D0000-0x000000000526C000-memory.dmpFilesize
624KB
-
memory/3664-10-0x00000000749B0000-0x0000000075160000-memory.dmpFilesize
7.7MB