Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 13:41
Behavioral task
behavioral1
Sample
2aaea866166221511fbd56b52f0cef64.exe
Resource
win7-20240221-en
General
-
Target
2aaea866166221511fbd56b52f0cef64.exe
-
Size
45KB
-
MD5
2aaea866166221511fbd56b52f0cef64
-
SHA1
58fb45e8808e6b523ba942088a45a49e780e6f2f
-
SHA256
09f0f7270df05c3dae84defc043db7b411a5f8610ea93a2c85dd98c7a927c47a
-
SHA512
de4029ade64782692fd4fae84f60d74587b73220f180d4b2b362c0670d980f2a04ecd1ecca0afafb8fad43f3fb11eafdade3002bba1686137a55a74fe50fc379
-
SSDEEP
768:NuLN+TwQhclWUlNzWmo2qDMKjPGaG6PIyzjbFgX3iN8F0S6d+Aj6gBDZOx:NuLN+Twip2lKTkDy3bCXSNS2Rj62dOx
Malware Config
Extracted
asyncrat
0.5.8
Default
94.228.162.82:6606
94.228.162.82:7707
94.228.162.82:8808
nZrC1RL7rHnC
-
delay
3
-
install
true
-
install_file
appBroker.exe
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-34-0x0000000005620000-0x0000000005682000-memory.dmp family_zgrat_v1 behavioral1/memory/2648-89-0x0000000006780000-0x000000000681C000-memory.dmp family_zgrat_v1 -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\xmrig.exe family_xmrig \Users\Admin\AppData\Local\Temp\xmrig.exe xmrig -
Async RAT payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\appBroker.exe family_asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
appBroker.exewmdlfg.exexmrig.exepid process 2648 appBroker.exe 2324 wmdlfg.exe 1536 xmrig.exe -
Loads dropped DLL 4 IoCs
Processes:
cmd.exepowershell.execmd.exepid process 2140 cmd.exe 1820 powershell.exe 1672 1704 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wmdlfg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\XMRig = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XMRig" wmdlfg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2664 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2aaea866166221511fbd56b52f0cef64.exepowershell.exeappBroker.exepid process 2524 2aaea866166221511fbd56b52f0cef64.exe 2524 2aaea866166221511fbd56b52f0cef64.exe 1820 powershell.exe 2648 appBroker.exe 1820 powershell.exe 1820 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2aaea866166221511fbd56b52f0cef64.exeappBroker.exepowershell.exexmrig.exedescription pid process Token: SeDebugPrivilege 2524 2aaea866166221511fbd56b52f0cef64.exe Token: SeDebugPrivilege 2648 appBroker.exe Token: SeDebugPrivilege 1820 powershell.exe Token: SeLockMemoryPrivilege 1536 xmrig.exe Token: SeLockMemoryPrivilege 1536 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 1536 xmrig.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
2aaea866166221511fbd56b52f0cef64.execmd.execmd.exeappBroker.execmd.exepowershell.exewmdlfg.execmd.execmd.exedescription pid process target process PID 2524 wrote to memory of 2880 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2880 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2880 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2880 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2140 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2140 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2140 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2524 wrote to memory of 2140 2524 2aaea866166221511fbd56b52f0cef64.exe cmd.exe PID 2880 wrote to memory of 2576 2880 cmd.exe schtasks.exe PID 2880 wrote to memory of 2576 2880 cmd.exe schtasks.exe PID 2880 wrote to memory of 2576 2880 cmd.exe schtasks.exe PID 2880 wrote to memory of 2576 2880 cmd.exe schtasks.exe PID 2140 wrote to memory of 2664 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2664 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2664 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2664 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2648 2140 cmd.exe appBroker.exe PID 2140 wrote to memory of 2648 2140 cmd.exe appBroker.exe PID 2140 wrote to memory of 2648 2140 cmd.exe appBroker.exe PID 2140 wrote to memory of 2648 2140 cmd.exe appBroker.exe PID 2648 wrote to memory of 2692 2648 appBroker.exe cmd.exe PID 2648 wrote to memory of 2692 2648 appBroker.exe cmd.exe PID 2648 wrote to memory of 2692 2648 appBroker.exe cmd.exe PID 2648 wrote to memory of 2692 2648 appBroker.exe cmd.exe PID 2692 wrote to memory of 1820 2692 cmd.exe powershell.exe PID 2692 wrote to memory of 1820 2692 cmd.exe powershell.exe PID 2692 wrote to memory of 1820 2692 cmd.exe powershell.exe PID 2692 wrote to memory of 1820 2692 cmd.exe powershell.exe PID 1820 wrote to memory of 2324 1820 powershell.exe wmdlfg.exe PID 1820 wrote to memory of 2324 1820 powershell.exe wmdlfg.exe PID 1820 wrote to memory of 2324 1820 powershell.exe wmdlfg.exe PID 1820 wrote to memory of 2324 1820 powershell.exe wmdlfg.exe PID 2324 wrote to memory of 3016 2324 wmdlfg.exe cmd.exe PID 2324 wrote to memory of 3016 2324 wmdlfg.exe cmd.exe PID 2324 wrote to memory of 3016 2324 wmdlfg.exe cmd.exe PID 3016 wrote to memory of 1704 3016 cmd.exe cmd.exe PID 3016 wrote to memory of 1704 3016 cmd.exe cmd.exe PID 3016 wrote to memory of 1704 3016 cmd.exe cmd.exe PID 1704 wrote to memory of 1536 1704 cmd.exe xmrig.exe PID 1704 wrote to memory of 1536 1704 cmd.exe xmrig.exe PID 1704 wrote to memory of 1536 1704 cmd.exe xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aaea866166221511fbd56b52f0cef64.exe"C:\Users\Admin\AppData\Local\Temp\2aaea866166221511fbd56b52f0cef64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "appBroker" /tr '"C:\Users\Admin\AppData\Roaming\appBroker.exe"'3⤵
- Creates scheduled task(s)
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3350.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2664 -
C:\Users\Admin\AppData\Roaming\appBroker.exe"C:\Users\Admin\AppData\Roaming\appBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wmdlfg.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wmdlfg.exe"'5⤵
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\wmdlfg.exe"C:\Users\Admin\AppData\Local\Temp\wmdlfg.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\xmrig.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\cmd.execmd.exe /C "C:\Users\Admin\AppData\Local\Temp\xmrig.exe"8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\xmrig.exeC:\Users\Admin\AppData\Local\Temp\xmrig.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar59AB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp3350.tmp.batFilesize
153B
MD5697393c0e44380aecf630ee27f61c958
SHA18eaf75dc9e5b25e05f9e00dc3e5079560be4d244
SHA256fee67e30f97a27f4cf8e97b0117fb68493c5dbb9e535fb377e6afdf3368e6f76
SHA512df00e788440e7dd7ba2c0eab705552a8bd4f8a057232c98b1ebd26e0516f17f9fa4d911ecadf469b4fd4badee359ff475a2341f4b407a99a30791f151fe362c7
-
C:\Users\Admin\AppData\Local\Temp\wmdlfg.exeFilesize
897KB
MD535c5c01f331c3cceb82c6ace1c98c0af
SHA193057d4839801cd9129e001db49d51670fe03f82
SHA2563e36c74c4fa98e8b91cbcdb2bd4a58a9fc4719b118de6cb16c2b14ff9206ad6e
SHA51204103379e9bb7e3b0b67320e2092500afe0f774cbca83d38190a548bbff28f514c305239223805ecb3cce416ef2d322a8eed28063ccbf2964b325b2b49a30653
-
\Users\Admin\AppData\Local\Temp\xmrig.exeFilesize
1.4MB
MD53866b487c4ed4865655a2e60b899bb7f
SHA172dc92d5b1ddafb3e5b35dc4212b58e838ffc491
SHA256c55a5e0c9f4acbcbfd11886aef71ec4ccf66ed0197710e5f82af1ff8e043207d
SHA5121d1d61b0ba9293c716af2ce292f34357a7bb4dd3e3e78f4a04ab4a04419f7bc247926bb8e49ad322b02a2cf2389aeff33155bc878699468fcf51b0e10f0ac8ba
-
\Users\Admin\AppData\Roaming\appBroker.exeFilesize
45KB
MD52aaea866166221511fbd56b52f0cef64
SHA158fb45e8808e6b523ba942088a45a49e780e6f2f
SHA25609f0f7270df05c3dae84defc043db7b411a5f8610ea93a2c85dd98c7a927c47a
SHA512de4029ade64782692fd4fae84f60d74587b73220f180d4b2b362c0670d980f2a04ecd1ecca0afafb8fad43f3fb11eafdade3002bba1686137a55a74fe50fc379
-
memory/2324-67-0x000000013FCA0000-0x000000013FD87000-memory.dmpFilesize
924KB
-
memory/2524-11-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2524-2-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2524-1-0x0000000000EB0000-0x0000000000EC2000-memory.dmpFilesize
72KB
-
memory/2524-0-0x000000007406E000-0x000000007406F000-memory.dmpFilesize
4KB
-
memory/2648-34-0x0000000005620000-0x0000000005682000-memory.dmpFilesize
392KB
-
memory/2648-16-0x0000000000F70000-0x0000000000F82000-memory.dmpFilesize
72KB
-
memory/2648-89-0x0000000006780000-0x000000000681C000-memory.dmpFilesize
624KB
-
memory/2648-110-0x0000000000F30000-0x0000000000F38000-memory.dmpFilesize
32KB
-
memory/2648-112-0x0000000000F60000-0x0000000000F6A000-memory.dmpFilesize
40KB
-
memory/2648-111-0x0000000005D00000-0x0000000005D40000-memory.dmpFilesize
256KB