Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 00:38
Behavioral task
behavioral1
Sample
Infected.exe
Resource
win7-20240221-en
General
-
Target
Infected.exe
-
Size
63KB
-
MD5
922ab616f4075a16637cd5ec43aa65e9
-
SHA1
10138fa4081ab37ed37ffe12ac8b4e8c72e40913
-
SHA256
a45fe62e39211eb7717ad31b5428e86789947bd2cb2628e2ed5c55989416e2b3
-
SHA512
93e07e54ac4e8af65636c25ce7cd8069fbb3f5c641ac7721edfbd202443a5c2f5b5d7b02b4a9ca6cf2faa5189877deb9d99661ee15ff77c037ab856969aacd8e
-
SSDEEP
768:A7yb0xqDayjrHrN78xIC8A+XjJazcBRL5JTk1+T4KSBGHmDbD/ph0oXa8lSnCwST:tQMLVzdSJYUbdh9a8X3uYdpqKmY7
Malware Config
Extracted
asyncrat
Default
choice-certainly.gl.at.ply.gg:24253
-
delay
1
-
install
true
-
install_file
Temp.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Temp.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Temp.exepid process 2096 Temp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2920 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Infected.exeTemp.exepid process 2236 Infected.exe 2236 Infected.exe 2236 Infected.exe 2236 Infected.exe 2236 Infected.exe 2236 Infected.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe 2096 Temp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Infected.exeTemp.exedescription pid process Token: SeDebugPrivilege 2236 Infected.exe Token: SeDebugPrivilege 2096 Temp.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Infected.execmd.execmd.exedescription pid process target process PID 2236 wrote to memory of 2652 2236 Infected.exe cmd.exe PID 2236 wrote to memory of 2652 2236 Infected.exe cmd.exe PID 2236 wrote to memory of 2652 2236 Infected.exe cmd.exe PID 2236 wrote to memory of 3024 2236 Infected.exe cmd.exe PID 2236 wrote to memory of 3024 2236 Infected.exe cmd.exe PID 2236 wrote to memory of 3024 2236 Infected.exe cmd.exe PID 2652 wrote to memory of 2572 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2572 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2572 2652 cmd.exe schtasks.exe PID 3024 wrote to memory of 2920 3024 cmd.exe timeout.exe PID 3024 wrote to memory of 2920 3024 cmd.exe timeout.exe PID 3024 wrote to memory of 2920 3024 cmd.exe timeout.exe PID 3024 wrote to memory of 2096 3024 cmd.exe Temp.exe PID 3024 wrote to memory of 2096 3024 cmd.exe Temp.exe PID 3024 wrote to memory of 2096 3024 cmd.exe Temp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Temp" /tr '"C:\Users\Admin\AppData\Local\Temp\Temp.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Temp" /tr '"C:\Users\Admin\AppData\Local\Temp\Temp.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5A9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Temp.exe"C:\Users\Admin\AppData\Local\Temp\Temp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Temp.exeFilesize
63KB
MD5922ab616f4075a16637cd5ec43aa65e9
SHA110138fa4081ab37ed37ffe12ac8b4e8c72e40913
SHA256a45fe62e39211eb7717ad31b5428e86789947bd2cb2628e2ed5c55989416e2b3
SHA51293e07e54ac4e8af65636c25ce7cd8069fbb3f5c641ac7721edfbd202443a5c2f5b5d7b02b4a9ca6cf2faa5189877deb9d99661ee15ff77c037ab856969aacd8e
-
C:\Users\Admin\AppData\Local\Temp\tmpB5A9.tmp.batFilesize
151B
MD521b7756f7d4073bc3aba2ad2de096148
SHA1f0fc599dd9523341ba166e3931f58b51dba30521
SHA2567232aa55b1008ce61f7363998feacd4c708c62e368e22c349f7757cd2e99d219
SHA512bfbde5708703acd45ca60b140dcdccb0abce9066002c65b2b51912c34b07ffe6117aa5370aae7bf6363c657c76925ef5ffad60bcbb547bac722c1e12faf8e965
-
memory/2096-18-0x0000000000080000-0x0000000000096000-memory.dmpFilesize
88KB
-
memory/2096-41-0x0000000076EF0000-0x0000000077099000-memory.dmpFilesize
1.7MB
-
memory/2096-40-0x0000000001F40000-0x0000000001FC0000-memory.dmpFilesize
512KB
-
memory/2096-39-0x000007FEF47B0000-0x000007FEF519C000-memory.dmpFilesize
9.9MB
-
memory/2096-21-0x0000000076EF0000-0x0000000077099000-memory.dmpFilesize
1.7MB
-
memory/2096-20-0x0000000001F40000-0x0000000001FC0000-memory.dmpFilesize
512KB
-
memory/2096-19-0x000007FEF47B0000-0x000007FEF519C000-memory.dmpFilesize
9.9MB
-
memory/2236-3-0x0000000076EF0000-0x0000000077099000-memory.dmpFilesize
1.7MB
-
memory/2236-13-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2236-14-0x0000000076EF0000-0x0000000077099000-memory.dmpFilesize
1.7MB
-
memory/2236-0-0x00000000001D0000-0x00000000001E6000-memory.dmpFilesize
88KB
-
memory/2236-2-0x000000001B160000-0x000000001B1E0000-memory.dmpFilesize
512KB
-
memory/2236-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB