Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:21
Behavioral task
behavioral1
Sample
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe
Resource
win7-20240903-en
General
-
Target
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe
-
Size
63KB
-
MD5
ab96f7fb7174a3056d894f91be3329a0
-
SHA1
588606b93b650594bf553ecb082c475fdf7ea4ae
-
SHA256
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d
-
SHA512
b7f8c5be8b319586c963003d068e720408178b1448ba2f6bd37b820a021faa4c1910df79a0c16673cf80633bb9e693182352daa387cd9d4f21d5361457620019
-
SSDEEP
768:otD5i7QHEU78j8C8A+XiV07hobtVZTnR48uyq1+T43SBGHmDbDBph0of3g4tyySj:GIgE8lwtNliQYUbrhB3g4AugdpqKmY7
Malware Config
Extracted
asyncrat
Default
127.0.0.1:4321
127.0.0.1:17567
company-parker.gl.at.ply.gg:4321
company-parker.gl.at.ply.gg:17567
-
delay
1
-
install
true
-
install_file
Grettaexecutor.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe -
Executes dropped EXE 1 IoCs
Processes:
Grettaexecutor.exepid process 2384 Grettaexecutor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4748 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exeGrettaexecutor.exepid process 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe 2384 Grettaexecutor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exeGrettaexecutor.exedescription pid process Token: SeDebugPrivilege 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe Token: SeDebugPrivilege 2384 Grettaexecutor.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.execmd.execmd.exedescription pid process target process PID 2684 wrote to memory of 3076 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe cmd.exe PID 2684 wrote to memory of 3076 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe cmd.exe PID 2684 wrote to memory of 4932 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe cmd.exe PID 2684 wrote to memory of 4932 2684 07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe cmd.exe PID 4932 wrote to memory of 4748 4932 cmd.exe timeout.exe PID 4932 wrote to memory of 4748 4932 cmd.exe timeout.exe PID 3076 wrote to memory of 3012 3076 cmd.exe schtasks.exe PID 3076 wrote to memory of 3012 3076 cmd.exe schtasks.exe PID 4932 wrote to memory of 2384 4932 cmd.exe Grettaexecutor.exe PID 4932 wrote to memory of 2384 4932 cmd.exe Grettaexecutor.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe"C:\Users\Admin\AppData\Local\Temp\07fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:3012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9D88.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4748
-
-
C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD59deef7519ff18e996b138841980bb20e
SHA1adf967fc762239b8a0f6932e828b85a2a66c65c6
SHA256664cc7f42ba222935530c22a90f31f1b2bd19173aeb3ddb87f3f3feb12e5da96
SHA5120b406123f15a94e3ff0424e9b7b796d0aa56a514dcea3f10ed488dc8626399a916f207ce6d47dab66f364a26961388203647dd2c167c3e123e3a4176b50265e6
-
Filesize
63KB
MD5ab96f7fb7174a3056d894f91be3329a0
SHA1588606b93b650594bf553ecb082c475fdf7ea4ae
SHA25607fd311ad86a3f0e100796eb0aaf9960400e800992e9a39008e6432ca824c66d
SHA512b7f8c5be8b319586c963003d068e720408178b1448ba2f6bd37b820a021faa4c1910df79a0c16673cf80633bb9e693182352daa387cd9d4f21d5361457620019