Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 00:38
Behavioral task
behavioral1
Sample
Infected.exe
Resource
win7-20240221-en
General
-
Target
Infected.exe
-
Size
63KB
-
MD5
922ab616f4075a16637cd5ec43aa65e9
-
SHA1
10138fa4081ab37ed37ffe12ac8b4e8c72e40913
-
SHA256
a45fe62e39211eb7717ad31b5428e86789947bd2cb2628e2ed5c55989416e2b3
-
SHA512
93e07e54ac4e8af65636c25ce7cd8069fbb3f5c641ac7721edfbd202443a5c2f5b5d7b02b4a9ca6cf2faa5189877deb9d99661ee15ff77c037ab856969aacd8e
-
SSDEEP
768:A7yb0xqDayjrHrN78xIC8A+XjJazcBRL5JTk1+T4KSBGHmDbD/ph0oXa8lSnCwST:tQMLVzdSJYUbdh9a8X3uYdpqKmY7
Malware Config
Extracted
asyncrat
Default
choice-certainly.gl.at.ply.gg:24253
-
delay
1
-
install
true
-
install_file
Temp.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Temp.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Infected.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation Infected.exe -
Executes dropped EXE 1 IoCs
Processes:
Temp.exepid process 2604 Temp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Infected.exeTemp.exepid process 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 4564 Infected.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe 2604 Temp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Infected.exeTemp.exedescription pid process Token: SeDebugPrivilege 4564 Infected.exe Token: SeDebugPrivilege 2604 Temp.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Infected.execmd.execmd.exedescription pid process target process PID 4564 wrote to memory of 3424 4564 Infected.exe cmd.exe PID 4564 wrote to memory of 3424 4564 Infected.exe cmd.exe PID 4564 wrote to memory of 4716 4564 Infected.exe cmd.exe PID 4564 wrote to memory of 4716 4564 Infected.exe cmd.exe PID 3424 wrote to memory of 412 3424 cmd.exe schtasks.exe PID 3424 wrote to memory of 412 3424 cmd.exe schtasks.exe PID 4716 wrote to memory of 1640 4716 cmd.exe timeout.exe PID 4716 wrote to memory of 1640 4716 cmd.exe timeout.exe PID 4716 wrote to memory of 2604 4716 cmd.exe Temp.exe PID 4716 wrote to memory of 2604 4716 cmd.exe Temp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Temp" /tr '"C:\Users\Admin\AppData\Local\Temp\Temp.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Temp" /tr '"C:\Users\Admin\AppData\Local\Temp\Temp.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3BFF.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Temp.exe"C:\Users\Admin\AppData\Local\Temp\Temp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Temp.exeFilesize
63KB
MD5922ab616f4075a16637cd5ec43aa65e9
SHA110138fa4081ab37ed37ffe12ac8b4e8c72e40913
SHA256a45fe62e39211eb7717ad31b5428e86789947bd2cb2628e2ed5c55989416e2b3
SHA51293e07e54ac4e8af65636c25ce7cd8069fbb3f5c641ac7721edfbd202443a5c2f5b5d7b02b4a9ca6cf2faa5189877deb9d99661ee15ff77c037ab856969aacd8e
-
C:\Users\Admin\AppData\Local\Temp\tmp3BFF.tmp.batFilesize
151B
MD56d4326edd7025cd2754f9d387f1210a1
SHA19a7daa47ab5ab787bc87590c7ee70372b8df7495
SHA256da00013f44d93f4b52e4807b69e03f9389cb5e0de73d62bfef4c177b32ec544f
SHA5127965e38ba84585e62dc7c61ce2578661fa1c4efd4553ee6ba7d6f611080f5a8652414c8c1cf8672c45a9792bf37eba76ca0e4f625af6971d6eb26b8983f15765
-
memory/2604-20-0x000000001CC40000-0x000000001CCB6000-memory.dmpFilesize
472KB
-
memory/2604-21-0x00000000017C0000-0x00000000017F4000-memory.dmpFilesize
208KB
-
memory/2604-25-0x00007FF96DFF0000-0x00007FF96E1E5000-memory.dmpFilesize
2.0MB
-
memory/2604-24-0x00000000017F0000-0x0000000001800000-memory.dmpFilesize
64KB
-
memory/2604-23-0x00007FF94FBF0000-0x00007FF9506B1000-memory.dmpFilesize
10.8MB
-
memory/2604-22-0x0000000003160000-0x000000000317E000-memory.dmpFilesize
120KB
-
memory/2604-14-0x00007FF94FBF0000-0x00007FF9506B1000-memory.dmpFilesize
10.8MB
-
memory/2604-15-0x00000000017F0000-0x0000000001800000-memory.dmpFilesize
64KB
-
memory/2604-16-0x00007FF96DFF0000-0x00007FF96E1E5000-memory.dmpFilesize
2.0MB
-
memory/2604-19-0x00007FF95E930000-0x00007FF95E949000-memory.dmpFilesize
100KB
-
memory/4564-2-0x000000001B1B0000-0x000000001B1C0000-memory.dmpFilesize
64KB
-
memory/4564-0-0x0000000000480000-0x0000000000496000-memory.dmpFilesize
88KB
-
memory/4564-1-0x00007FF94FFF0000-0x00007FF950AB1000-memory.dmpFilesize
10.8MB
-
memory/4564-8-0x00007FF95E930000-0x00007FF95E949000-memory.dmpFilesize
100KB
-
memory/4564-9-0x00007FF94FFF0000-0x00007FF950AB1000-memory.dmpFilesize
10.8MB
-
memory/4564-7-0x00007FF96DFF0000-0x00007FF96E1E5000-memory.dmpFilesize
2.0MB