Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 12:08
Behavioral task
behavioral1
Sample
f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe
Resource
win7-20240611-en
General
-
Target
f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe
-
Size
545KB
-
MD5
9c17bdda52e21d8df835cee315b506dd
-
SHA1
f01ccf02c4b92dc8e261da1e48f54ccd548c8af0
-
SHA256
f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f
-
SHA512
7acd79e169949ef7445230ea474a38786cda317469be340fa94b83dcf26b0025b0baff45ff37c88c632ceaef6565a503d7f19d3884c467f8d68c28f86c3f9889
-
SSDEEP
12288:BrMNAQs0dT4WxW+x4WrD5D4TIVz1OhZcsY:B4NAed3VJOHzY
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000021f87-8.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe -
Executes dropped EXE 1 IoCs
pid Process 3328 $77-sachost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3568 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe Token: SeDebugPrivilege 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe Token: SeDebugPrivilege 3328 $77-sachost.exe Token: SeDebugPrivilege 3328 $77-sachost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 540 wrote to memory of 1752 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 87 PID 540 wrote to memory of 1752 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 87 PID 540 wrote to memory of 4040 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 89 PID 540 wrote to memory of 4040 540 f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe 89 PID 1752 wrote to memory of 4628 1752 cmd.exe 91 PID 1752 wrote to memory of 4628 1752 cmd.exe 91 PID 4040 wrote to memory of 3568 4040 cmd.exe 92 PID 4040 wrote to memory of 3568 4040 cmd.exe 92 PID 4040 wrote to memory of 3328 4040 cmd.exe 93 PID 4040 wrote to memory of 3328 4040 cmd.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe"C:\Users\Admin\AppData\Local\Temp\f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-sachost" /tr '"C:\Users\Admin\AppData\Roaming\$77-sachost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "$77-sachost" /tr '"C:\Users\Admin\AppData\Roaming\$77-sachost.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp51C9.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3568
-
-
C:\Users\Admin\AppData\Roaming\$77-sachost.exe"C:\Users\Admin\AppData\Roaming\$77-sachost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD54b4ebe0e1cd31c44697b06e2caac535b
SHA1dcaece0e604b0bb2e21f8db12e48ab6eb643336a
SHA2563d6a35117bb02e27656a1eff7c9f76247d21733e60889ed0f3abf171afde543d
SHA5129fad6065b2a63e77b5aad6ab92efee76bcd02cadbb25d0d05f00a5d06123126d71d14f41ecf9f036e985aa0249a86b90ce39bb047cedaa2d9d1cb2f57787539a
-
Filesize
545KB
MD59c17bdda52e21d8df835cee315b506dd
SHA1f01ccf02c4b92dc8e261da1e48f54ccd548c8af0
SHA256f8bcd12f0b30a378747069cc28aaae74d30aafc33656152ee34f818a10e8973f
SHA5127acd79e169949ef7445230ea474a38786cda317469be340fa94b83dcf26b0025b0baff45ff37c88c632ceaef6565a503d7f19d3884c467f8d68c28f86c3f9889