Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 01:34
Behavioral task
behavioral1
Sample
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
Resource
win7-20240221-en
General
-
Target
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
-
Size
63KB
-
MD5
b8d455465260a845db35492fda5a8888
-
SHA1
287b0ba049ad8f3be802d2224efb86dba72d3221
-
SHA256
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
-
SHA512
5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
-
SSDEEP
768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7
Malware Config
Extracted
asyncrat
Default
66.235.168.242:3232
-
delay
1
-
install
true
-
install_file
Loaader.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Loaader.exe family_asyncrat -
Detects executables attemping to enumerate video devices using WMI 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1924-0-0x0000000000910000-0x0000000000926000-memory.dmp INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice C:\Users\Admin\AppData\Roaming\Loaader.exe INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice -
Detects executables containing the string DcRatBy 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1924-0-0x0000000000910000-0x0000000000926000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DcRatBy C:\Users\Admin\AppData\Roaming\Loaader.exe INDICATOR_SUSPICIOUS_EXE_DcRatBy -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe -
Executes dropped EXE 1 IoCs
Processes:
Loaader.exepid process 1984 Loaader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3148 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exepid process 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exeLoaader.exedescription pid process Token: SeDebugPrivilege 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe Token: SeDebugPrivilege 1984 Loaader.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.execmd.execmd.exedescription pid process target process PID 1924 wrote to memory of 2864 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe cmd.exe PID 1924 wrote to memory of 2864 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe cmd.exe PID 1924 wrote to memory of 3504 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe cmd.exe PID 1924 wrote to memory of 3504 1924 a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe cmd.exe PID 2864 wrote to memory of 2720 2864 cmd.exe schtasks.exe PID 2864 wrote to memory of 2720 2864 cmd.exe schtasks.exe PID 3504 wrote to memory of 3148 3504 cmd.exe timeout.exe PID 3504 wrote to memory of 3148 3504 cmd.exe timeout.exe PID 3504 wrote to memory of 1984 3504 cmd.exe Loaader.exe PID 3504 wrote to memory of 1984 3504 cmd.exe Loaader.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe"C:\Users\Admin\AppData\Local\Temp\a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A19.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Loaader.exe"C:\Users\Admin\AppData\Roaming\Loaader.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4A19.tmp.batFilesize
151B
MD5a1a11c0d3aef826cb8084ef2acb67b0e
SHA1154db4923a7914f62ee6e741e4c585b64f874b47
SHA256676eed51e01afe70c8040e557cbe6220f50ce9f50a7ac9e4debbbc79a09c6284
SHA512ba4e794037751ac6e1a3745878770b7ad08e3d9ca80198aedf48eef6f8329fd8e27dfa8a96a59dbc3136ee81c64bc1abb885c6240a8b9865c56089a459a597f6
-
C:\Users\Admin\AppData\Roaming\Loaader.exeFilesize
63KB
MD5b8d455465260a845db35492fda5a8888
SHA1287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA5125dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
-
memory/1924-0-0x0000000000910000-0x0000000000926000-memory.dmpFilesize
88KB
-
memory/1924-1-0x00007FFB43783000-0x00007FFB43785000-memory.dmpFilesize
8KB
-
memory/1924-2-0x00007FFB43780000-0x00007FFB44241000-memory.dmpFilesize
10.8MB
-
memory/1924-7-0x00007FFB43780000-0x00007FFB44241000-memory.dmpFilesize
10.8MB