Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:52
Behavioral task
behavioral1
Sample
b8d455465260a845db35492fda5a8888.exe
Resource
win7-20240508-en
General
-
Target
b8d455465260a845db35492fda5a8888.exe
-
Size
63KB
-
MD5
b8d455465260a845db35492fda5a8888
-
SHA1
287b0ba049ad8f3be802d2224efb86dba72d3221
-
SHA256
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
-
SHA512
5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
-
SSDEEP
768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7
Malware Config
Extracted
asyncrat
Default
66.235.168.242:3232
-
delay
1
-
install
true
-
install_file
Loaader.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Loaader.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b8d455465260a845db35492fda5a8888.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation b8d455465260a845db35492fda5a8888.exe -
Executes dropped EXE 1 IoCs
Processes:
Loaader.exepid process 4996 Loaader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3380 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
b8d455465260a845db35492fda5a8888.exepid process 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe 4524 b8d455465260a845db35492fda5a8888.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b8d455465260a845db35492fda5a8888.exeLoaader.exedescription pid process Token: SeDebugPrivilege 4524 b8d455465260a845db35492fda5a8888.exe Token: SeDebugPrivilege 4996 Loaader.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
b8d455465260a845db35492fda5a8888.execmd.execmd.exedescription pid process target process PID 4524 wrote to memory of 2536 4524 b8d455465260a845db35492fda5a8888.exe cmd.exe PID 4524 wrote to memory of 2536 4524 b8d455465260a845db35492fda5a8888.exe cmd.exe PID 4524 wrote to memory of 2900 4524 b8d455465260a845db35492fda5a8888.exe cmd.exe PID 4524 wrote to memory of 2900 4524 b8d455465260a845db35492fda5a8888.exe cmd.exe PID 2900 wrote to memory of 3380 2900 cmd.exe timeout.exe PID 2900 wrote to memory of 3380 2900 cmd.exe timeout.exe PID 2536 wrote to memory of 2924 2536 cmd.exe schtasks.exe PID 2536 wrote to memory of 2924 2536 cmd.exe schtasks.exe PID 2900 wrote to memory of 4996 2900 cmd.exe Loaader.exe PID 2900 wrote to memory of 4996 2900 cmd.exe Loaader.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d455465260a845db35492fda5a8888.exe"C:\Users\Admin\AppData\Local\Temp\b8d455465260a845db35492fda5a8888.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4DD2.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Loaader.exe"C:\Users\Admin\AppData\Roaming\Loaader.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4DD2.tmp.batFilesize
151B
MD5daff4fe22f8a62cb5d161e7336c37386
SHA14f1f0b520a0a12c7554677d48d6da6773fb90f67
SHA25653948362268c69533e8ba08f78ac005d2633fc022c662dc57a978c6ba32e96cf
SHA5121c6d5654873a31013061c387294b31cac74fb004ef4a4adda6104ba41527755bb0ad18cd87a265cb76e758ee589caaf5cbf8b4e31c6823df043a8a9b3b8f33a8
-
C:\Users\Admin\AppData\Roaming\Loaader.exeFilesize
63KB
MD5b8d455465260a845db35492fda5a8888
SHA1287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA5125dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
-
memory/4524-0-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmpFilesize
8KB
-
memory/4524-1-0x0000000000090000-0x00000000000A6000-memory.dmpFilesize
88KB
-
memory/4524-2-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmpFilesize
10.8MB
-
memory/4524-7-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmpFilesize
10.8MB
-
memory/4524-14-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmpFilesize
10.8MB