Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe
Resource
win7-20240221-en
General
-
Target
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe
-
Size
897KB
-
MD5
db6bf30fd61d330a5466459124fd4f21
-
SHA1
5beef951cc1052daeca87d5ef69999b3d0cc1381
-
SHA256
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe
-
SHA512
f794a8ed161e23951299890660fd98f42cd0159aca9d6f653263170b0c63ab8b6a4ba2101f13862541440b01517da2c6348a26f1a1cec470878abe4b796474dd
-
SSDEEP
24576:KMPzX5QdJTGSQfTWJcWF2dZ7T8IY3Sd+L0S6D9:KMLqXTGSjcQmZ7QIcSEmD
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
zaqhepdivuiitce
-
delay
5
-
install
true
-
install_file
sezznam.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2140-2-0x00000000001F0000-0x0000000000202000-memory.dmp family_asyncrat behavioral1/memory/2492-18-0x0000000000330000-0x0000000000342000-memory.dmp family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
sezznam.exepid process 2492 sezznam.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2448 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2312 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exepid process 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exesezznam.exedescription pid process Token: SeDebugPrivilege 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe Token: SeDebugPrivilege 2492 sezznam.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.execmd.execmd.exedescription pid process target process PID 2140 wrote to memory of 2128 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2128 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2128 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2128 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2448 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2448 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2448 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2140 wrote to memory of 2448 2140 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2128 wrote to memory of 2284 2128 cmd.exe schtasks.exe PID 2128 wrote to memory of 2284 2128 cmd.exe schtasks.exe PID 2128 wrote to memory of 2284 2128 cmd.exe schtasks.exe PID 2128 wrote to memory of 2284 2128 cmd.exe schtasks.exe PID 2448 wrote to memory of 2312 2448 cmd.exe timeout.exe PID 2448 wrote to memory of 2312 2448 cmd.exe timeout.exe PID 2448 wrote to memory of 2312 2448 cmd.exe timeout.exe PID 2448 wrote to memory of 2312 2448 cmd.exe timeout.exe PID 2448 wrote to memory of 2492 2448 cmd.exe sezznam.exe PID 2448 wrote to memory of 2492 2448 cmd.exe sezznam.exe PID 2448 wrote to memory of 2492 2448 cmd.exe sezznam.exe PID 2448 wrote to memory of 2492 2448 cmd.exe sezznam.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe"C:\Users\Admin\AppData\Local\Temp\20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe /tr '"C:\Users\Admin\AppData\Roaming\sezznam.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe /tr '"C:\Users\Admin\AppData\Roaming\sezznam.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp39F4.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\sezznam.exe"C:\Users\Admin\AppData\Roaming\sezznam.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp39F4.tmp.batFilesize
151B
MD5ca067090c069529c2bca36597c21a826
SHA19239f48f307bb20e19a01cd3b2418aba0f48750a
SHA256d3beda64ac2ad7b7411d4b6b0f6e7a156342e3045147f3dc73029e646853c6cf
SHA512e72cd26cde8fc7f1b85dfc2df13913085238be371db2ec2285e196748028bd14bda7e3cc1821d367a06ab5cdc9cfe67fa1802ab1e7f228cccf0e1839b8c9bb60
-
C:\Users\Admin\AppData\Roaming\sezznam.exeFilesize
897KB
MD5db6bf30fd61d330a5466459124fd4f21
SHA15beef951cc1052daeca87d5ef69999b3d0cc1381
SHA25620e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe
SHA512f794a8ed161e23951299890660fd98f42cd0159aca9d6f653263170b0c63ab8b6a4ba2101f13862541440b01517da2c6348a26f1a1cec470878abe4b796474dd
-
memory/2140-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmpFilesize
4KB
-
memory/2140-1-0x00000000003C0000-0x00000000004A6000-memory.dmpFilesize
920KB
-
memory/2140-2-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/2140-3-0x0000000074C90000-0x000000007537E000-memory.dmpFilesize
6.9MB
-
memory/2140-13-0x0000000074C90000-0x000000007537E000-memory.dmpFilesize
6.9MB
-
memory/2492-17-0x0000000000390000-0x0000000000476000-memory.dmpFilesize
920KB
-
memory/2492-18-0x0000000000330000-0x0000000000342000-memory.dmpFilesize
72KB