Analysis
-
max time kernel
1797s -
max time network
1801s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
18-11-2024 01:09
General
-
Target
Infected.exe
-
Size
63KB
-
MD5
daacc4b40206c4d5e7260dde1a2f6814
-
SHA1
7f8baeba108d745c44ee23b4a56c58d5893d2889
-
SHA256
eb3e3b70ceb124de827b5297c2b8e0b42f84ca8bcd71015a9ce9d7aa5a581a43
-
SHA512
3afd3cbe4ae7e9e500037a1643ba04430687a602d6a4b7ccb9c12e8b350b29fcb37251b9cb9af4528f92719b6ae4391aea5f58aa505dfd6818b9e0cb036dcf64
-
SSDEEP
768:iqWcYBjjj78ZIC8A+X0iazcBRL5JTk1+T4KSBGHmDbD/ph0oXTOsySuwdpqKYhY7:MZjLXdSJYUbdh9TluwdpqKmY7
Malware Config
Extracted
asyncrat
Default
147.185.221.23:45700
-
delay
1
-
install
true
-
install_file
urmom.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0029000000045040-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation Infected.exe -
Executes dropped EXE 1 IoCs
pid Process 1760 urmom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3956 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4380 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe 1164 Infected.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1164 Infected.exe Token: SeDebugPrivilege 1164 Infected.exe Token: SeDebugPrivilege 1760 urmom.exe Token: SeDebugPrivilege 1760 urmom.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1164 wrote to memory of 116 1164 Infected.exe 82 PID 1164 wrote to memory of 116 1164 Infected.exe 82 PID 1164 wrote to memory of 4600 1164 Infected.exe 84 PID 1164 wrote to memory of 4600 1164 Infected.exe 84 PID 116 wrote to memory of 4380 116 cmd.exe 86 PID 116 wrote to memory of 4380 116 cmd.exe 86 PID 4600 wrote to memory of 3956 4600 cmd.exe 87 PID 4600 wrote to memory of 3956 4600 cmd.exe 87 PID 4600 wrote to memory of 1760 4600 cmd.exe 92 PID 4600 wrote to memory of 1760 4600 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "urmom" /tr '"C:\Users\Admin\AppData\Roaming\urmom.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "urmom" /tr '"C:\Users\Admin\AppData\Roaming\urmom.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8482.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3956
-
-
C:\Users\Admin\AppData\Roaming\urmom.exe"C:\Users\Admin\AppData\Roaming\urmom.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5f68d4d174082c3b689e091e04bbdfc88
SHA166c130bab4373b229b96e2e4f81ad6e5a62c8cf3
SHA2562b2d3b6bc44c7133b2538a060c4122c14d28a11f1dbd981cfa0fe85affa7decf
SHA512056145a59e52992557c0adaafbb0ffc66e1759122e4ab3230659de055b7743f82105497b050261d5331c9a56e1b29d142da4a056892c06229d703a3aa5dd412f
-
Filesize
63KB
MD5daacc4b40206c4d5e7260dde1a2f6814
SHA17f8baeba108d745c44ee23b4a56c58d5893d2889
SHA256eb3e3b70ceb124de827b5297c2b8e0b42f84ca8bcd71015a9ce9d7aa5a581a43
SHA5123afd3cbe4ae7e9e500037a1643ba04430687a602d6a4b7ccb9c12e8b350b29fcb37251b9cb9af4528f92719b6ae4391aea5f58aa505dfd6818b9e0cb036dcf64