Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 12:40
Behavioral task
behavioral1
Sample
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
Resource
win7-20241010-en
General
-
Target
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
-
Size
63KB
-
MD5
103629304104bf87dc75a086f3aebdb2
-
SHA1
6a03d4e5bba8c4ffb6c7432f948951b9c6064130
-
SHA256
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
-
SHA512
30647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604
-
SSDEEP
768:otD5i7QHEU78j8C8A+XiV07hobtVZTnR48uyq1+T43SBGHmDbDBph0of3g4tyySI:GIgE8lwtNliQYUbrhB3g4AugdpqKmY7E
Malware Config
Extracted
asyncrat
Default
127.0.0.1:4321
127.0.0.1:17567
company-parker.gl.at.ply.gg:4321
company-parker.gl.at.ply.gg:17567
-
delay
1
-
install
true
-
install_file
Grettaexecutor.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c92-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe -
Executes dropped EXE 1 IoCs
pid Process 3984 Grettaexecutor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2372 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe 3984 Grettaexecutor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe Token: SeDebugPrivilege 3984 Grettaexecutor.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2300 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 83 PID 4780 wrote to memory of 2300 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 83 PID 4780 wrote to memory of 2004 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 85 PID 4780 wrote to memory of 2004 4780 d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe 85 PID 2004 wrote to memory of 2372 2004 cmd.exe 87 PID 2004 wrote to memory of 2372 2004 cmd.exe 87 PID 2300 wrote to memory of 1064 2300 cmd.exe 88 PID 2300 wrote to memory of 1064 2300 cmd.exe 88 PID 2004 wrote to memory of 3984 2004 cmd.exe 95 PID 2004 wrote to memory of 3984 2004 cmd.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe"C:\Users\Admin\AppData\Local\Temp\d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Grettaexecutor" /tr '"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:1064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp93F3.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2372
-
-
C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"C:\Users\Admin\AppData\Roaming\Grettaexecutor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD527354d05bf36ad3b7370ae0561c57098
SHA1243b680616a7b8dffcf7e9db18d67eb0f3afba3e
SHA2564c8f56b552b724bf64e3e93c09b1a8ec21afca56fce673b3683e830cc91d44ab
SHA512ddec3c2a7f3dbdc2aeaa52cdce1821cdd7e569d3d46b96563d0f3c365137700ec7d110e4af0ffb9e6ff55db91bd75f24aa2fab30b2bffe572ce81a6a8befd449
-
Filesize
63KB
MD5103629304104bf87dc75a086f3aebdb2
SHA16a03d4e5bba8c4ffb6c7432f948951b9c6064130
SHA256d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
SHA51230647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604