Analysis
-
max time kernel
47s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
Bygay Ultimatum.exe
Resource
win7-20240220-en
General
-
Target
Bygay Ultimatum.exe
-
Size
111KB
-
MD5
69a08abd99af2c0de3ddae4f041579e2
-
SHA1
de04d6d17aea96d673f0ded3cb5731d4b62b97bc
-
SHA256
34ddc970cca5e3a8646c6355d21d74c3c6405871f14306740b420395c3df65a7
-
SHA512
bd1244e34d6fa7fa080e272fe5371e6f1318a90b864da18aff14b999496fc64d1bb9a4573d6ce749f20cda631a05f64bdbdb86c100840cb1171eedaa29947b25
-
SSDEEP
3072:p1HXoZq4xFSz8BIVJ91frkQIi/URe8642ZCUeFQ:fXSq4HSz8BIwBi/UM86xleF
Malware Config
Extracted
asyncrat
Default
polaris1314-38723.portmap.host:38723
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Bygay Ultimate.exe family_asyncrat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bygay Ultimatum.exeBygay Ultimate.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Bygay Ultimatum.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Bygay Ultimate.exe -
Executes dropped EXE 2 IoCs
Processes:
Bygay Ultimate.exesvchost.exepid process 4480 Bygay Ultimate.exe 2180 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3400 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Bygay Ultimate.exesvchost.exepid process 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 4480 Bygay Ultimate.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe 2180 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Bygay Ultimate.exesvchost.exedescription pid process Token: SeDebugPrivilege 4480 Bygay Ultimate.exe Token: SeDebugPrivilege 4480 Bygay Ultimate.exe Token: SeDebugPrivilege 2180 svchost.exe Token: SeDebugPrivilege 2180 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Bygay Ultimatum.exeBygay Ultimate.execmd.execmd.exedescription pid process target process PID 2580 wrote to memory of 4480 2580 Bygay Ultimatum.exe Bygay Ultimate.exe PID 2580 wrote to memory of 4480 2580 Bygay Ultimatum.exe Bygay Ultimate.exe PID 4480 wrote to memory of 1208 4480 Bygay Ultimate.exe cmd.exe PID 4480 wrote to memory of 1208 4480 Bygay Ultimate.exe cmd.exe PID 4480 wrote to memory of 1108 4480 Bygay Ultimate.exe cmd.exe PID 4480 wrote to memory of 1108 4480 Bygay Ultimate.exe cmd.exe PID 1108 wrote to memory of 3400 1108 cmd.exe timeout.exe PID 1108 wrote to memory of 3400 1108 cmd.exe timeout.exe PID 1208 wrote to memory of 2408 1208 cmd.exe schtasks.exe PID 1208 wrote to memory of 2408 1208 cmd.exe schtasks.exe PID 1108 wrote to memory of 2180 1108 cmd.exe svchost.exe PID 1108 wrote to memory of 2180 1108 cmd.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bygay Ultimatum.exe"C:\Users\Admin\AppData\Local\Temp\Bygay Ultimatum.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\Bygay Ultimate.exe"C:\Users\Admin\AppData\Local\Temp\Bygay Ultimate.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"'4⤵
- Creates scheduled task(s)
PID:2408 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp49EA.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Bygay Ultimate.exeFilesize
67KB
MD594bbbe48c09379faa010ac277482e08f
SHA14e291be001c08a57a94e26f35ed5312408666904
SHA2561c11f8605d446170a2f078188dc1738974cc4cf85b26d6866eda542cf5af960c
SHA512d6272d89782a396475cb3f990906855f968fdffbe61b08e4c278670ea69c3f0481a929efed2ac5b35c22b4e7a83b1b9d0526341f853d933f3cb7b78162905085
-
C:\Users\Admin\AppData\Local\Temp\tmp49EA.tmp.batFilesize
154B
MD51260762649e4318a9e2bdd6cba9b68c6
SHA1e56305768cbdb96811380b69f1c9cba893be3f0b
SHA256aa797cc32cf936b8e51a385a0998d21d5e6233e60f18dd18e7c50bd4670e079a
SHA5124dfc801b5a78bd71d3ed5ddb1eb2235bcdc89bc69c66ea959d280be276440eb0879e1ec2b097c46489ac8a408d43555bd84566e3b1351a18e46d9cc02129879f
-
memory/2580-0-0x00007FFBFBB53000-0x00007FFBFBB55000-memory.dmpFilesize
8KB
-
memory/2580-1-0x0000000000E70000-0x0000000000E92000-memory.dmpFilesize
136KB
-
memory/4480-14-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/4480-15-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmpFilesize
10.8MB
-
memory/4480-16-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmpFilesize
10.8MB
-
memory/4480-19-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmpFilesize
10.8MB
-
memory/4480-22-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmpFilesize
10.8MB