Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 05:50
Behavioral task
behavioral1
Sample
ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe
Resource
win7-20240729-en
General
-
Target
ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe
-
Size
63KB
-
MD5
5f00c912f2ac12df8525a30afb8f776e
-
SHA1
516af350678a65e9e10901b8c990ef4601ae0844
-
SHA256
ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a
-
SHA512
5e9e96ed14d4c1fff020d9d1d00f137cbf1121cd5c3c58a054002d7d1f29a417b6f2f71d8f534c7207ea6bd87a3b57d7afea76390b90a1c8badf482dbba710d5
-
SSDEEP
1536:FhMpLbRQkB4+ENds+jFBncsSRoAGbbzwHvGHtpqKmY7:FhMpLbRQkB4tds+jFBl2JGbbzt2z
Malware Config
Extracted
asyncrat
1.2
Default
stores-less.gl.at.ply.gg:45080
AtomRatMutex_penka
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x00070000000120fd-15.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2868 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1872 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1652 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe Token: SeDebugPrivilege 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe Token: SeDebugPrivilege 2868 svchost.exe Token: SeDebugPrivilege 2868 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2088 wrote to memory of 3032 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 30 PID 2088 wrote to memory of 3032 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 30 PID 2088 wrote to memory of 3032 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 30 PID 2088 wrote to memory of 2944 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 31 PID 2088 wrote to memory of 2944 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 31 PID 2088 wrote to memory of 2944 2088 ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe 31 PID 3032 wrote to memory of 1652 3032 cmd.exe 34 PID 3032 wrote to memory of 1652 3032 cmd.exe 34 PID 3032 wrote to memory of 1652 3032 cmd.exe 34 PID 2944 wrote to memory of 1872 2944 cmd.exe 35 PID 2944 wrote to memory of 1872 2944 cmd.exe 35 PID 2944 wrote to memory of 1872 2944 cmd.exe 35 PID 2944 wrote to memory of 2868 2944 cmd.exe 36 PID 2944 wrote to memory of 2868 2944 cmd.exe 36 PID 2944 wrote to memory of 2868 2944 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe"C:\Users\Admin\AppData\Local\Temp\ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:1652
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9608.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1872
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD51b3517842d56941fd4f82cc393182359
SHA1a56afa7645e341942568ec54d8d577b81c82be52
SHA25691976d3ab1be2f66f5356bd2a370d05bcc3197cd647254716a4b79e29c60086b
SHA5122fa7a42fa5d7d2e5afe7b406b5282edae66f99e8698a4280f0e833ac939bb4eba65e4466d0f37ea5e65a6f3e369c15dd6852d908c2611b1af9d13b4adf001c99
-
Filesize
63KB
MD55f00c912f2ac12df8525a30afb8f776e
SHA1516af350678a65e9e10901b8c990ef4601ae0844
SHA256ffe2d2e6b930f0b8f752d2a478d77cfbf9467006d294474fe33970a8c529b75a
SHA5125e9e96ed14d4c1fff020d9d1d00f137cbf1121cd5c3c58a054002d7d1f29a417b6f2f71d8f534c7207ea6bd87a3b57d7afea76390b90a1c8badf482dbba710d5