Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 12:40
Behavioral task
behavioral1
Sample
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
Resource
win7-20241010-en
General
-
Target
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
-
Size
63KB
-
MD5
103629304104bf87dc75a086f3aebdb2
-
SHA1
6a03d4e5bba8c4ffb6c7432f948951b9c6064130
-
SHA256
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
-
SHA512
30647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604
-
SSDEEP
768:otD5i7QHEU78j8C8A+XiV07hobtVZTnR48uyq1+T43SBGHmDbDBph0of3g4tyySI:GIgE8lwtNliQYUbrhB3g4AugdpqKmY7E
Malware Config
Extracted
asyncrat
Default
127.0.0.1:4321
127.0.0.1:17567
company-parker.gl.at.ply.gg:4321
company-parker.gl.at.ply.gg:17567
-
delay
1
-
install
true
-
install_file
Grettaexecutor.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000800000001227e-15.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2732 Grettaexecutor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2932 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe 2732 Grettaexecutor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe Token: SeDebugPrivilege 2732 Grettaexecutor.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2448 wrote to memory of 3020 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 30 PID 2448 wrote to memory of 3020 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 30 PID 2448 wrote to memory of 3020 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 30 PID 2448 wrote to memory of 3004 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 32 PID 2448 wrote to memory of 3004 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 32 PID 2448 wrote to memory of 3004 2448 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 32 PID 3020 wrote to memory of 2656 3020 cmd.exe 34 PID 3020 wrote to memory of 2656 3020 cmd.exe 34 PID 3020 wrote to memory of 2656 3020 cmd.exe 34 PID 3004 wrote to memory of 2932 3004 cmd.exe 35 PID 3004 wrote to memory of 2932 3004 cmd.exe 35 PID 3004 wrote to memory of 2932 3004 cmd.exe 35 PID 3004 wrote to memory of 2732 3004 cmd.exe 36 PID 3004 wrote to memory of 2732 3004 cmd.exe 36 PID 3004 wrote to memory of 2732 3004 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe"C:\Users\Admin\AppData\Local\Temp\d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2656
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5199.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2932
-
-
C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD55e0aca5e91449989c5549efbac0daa99
SHA19d6e94ced199dae749ae704df988f43f06aa62ba
SHA256491d5159cfcfa56142d9fe87f6bbdba93bf313d01f61b00971db2f05e16bb022
SHA5124a842a8243dfae8e1074f0d651b99704bb95e78055402d37ee013e34653a95f6c7479c9d4bd1c52030d96d0fb774b00352dd0d3e9737d433f71aecca2f7cafc9
-
Filesize
63KB
MD5103629304104bf87dc75a086f3aebdb2
SHA16a03d4e5bba8c4ffb6c7432f948951b9c6064130
SHA256d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
SHA51230647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604