Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe
Resource
win7-20240221-en
General
-
Target
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe
-
Size
897KB
-
MD5
db6bf30fd61d330a5466459124fd4f21
-
SHA1
5beef951cc1052daeca87d5ef69999b3d0cc1381
-
SHA256
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe
-
SHA512
f794a8ed161e23951299890660fd98f42cd0159aca9d6f653263170b0c63ab8b6a4ba2101f13862541440b01517da2c6348a26f1a1cec470878abe4b796474dd
-
SSDEEP
24576:KMPzX5QdJTGSQfTWJcWF2dZ7T8IY3Sd+L0S6D9:KMLqXTGSjcQmZ7QIcSEmD
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
zaqhepdivuiitce
-
delay
5
-
install
true
-
install_file
sezznam.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2148-4-0x0000000002DB0000-0x0000000002DC2000-memory.dmp family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe -
Executes dropped EXE 1 IoCs
Processes:
sezznam.exepid process 2384 sezznam.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3964 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exepid process 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exesezznam.exedescription pid process Token: SeDebugPrivilege 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe Token: SeDebugPrivilege 2384 sezznam.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.execmd.execmd.exedescription pid process target process PID 2148 wrote to memory of 1968 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2148 wrote to memory of 1968 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2148 wrote to memory of 1968 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2148 wrote to memory of 4352 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2148 wrote to memory of 4352 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 2148 wrote to memory of 4352 2148 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe cmd.exe PID 1968 wrote to memory of 1000 1968 cmd.exe schtasks.exe PID 1968 wrote to memory of 1000 1968 cmd.exe schtasks.exe PID 1968 wrote to memory of 1000 1968 cmd.exe schtasks.exe PID 4352 wrote to memory of 3964 4352 cmd.exe timeout.exe PID 4352 wrote to memory of 3964 4352 cmd.exe timeout.exe PID 4352 wrote to memory of 3964 4352 cmd.exe timeout.exe PID 4352 wrote to memory of 2384 4352 cmd.exe sezznam.exe PID 4352 wrote to memory of 2384 4352 cmd.exe sezznam.exe PID 4352 wrote to memory of 2384 4352 cmd.exe sezznam.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe"C:\Users\Admin\AppData\Local\Temp\20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe /tr '"C:\Users\Admin\AppData\Roaming\sezznam.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 20e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe /tr '"C:\Users\Admin\AppData\Roaming\sezznam.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp59E7.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\sezznam.exe"C:\Users\Admin\AppData\Roaming\sezznam.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp59E7.tmp.batFilesize
151B
MD50e4262616549e48b70aa82aeeea79c99
SHA16a6aa9a6e8ee3dc8ed05a8658432d64fd5642c84
SHA256b88167dda687578e2b24c423f62aadb6ea8de72e9eb39b131a9271275b9861f3
SHA512650e4df9becfc44c73a4f96f4e67a2e1c71e0527bde2aaa247d8c3913b6106ada9cc37efb8cb2387f5b228433e30348ea73c55215a0405998bdb0ab319331963
-
C:\Users\Admin\AppData\Roaming\sezznam.exeFilesize
897KB
MD5db6bf30fd61d330a5466459124fd4f21
SHA15beef951cc1052daeca87d5ef69999b3d0cc1381
SHA25620e3320ed125693938485c94c8ebf1a981ed2d717bba86f137a4b327757946fe
SHA512f794a8ed161e23951299890660fd98f42cd0159aca9d6f653263170b0c63ab8b6a4ba2101f13862541440b01517da2c6348a26f1a1cec470878abe4b796474dd
-
memory/2148-3-0x00000000053E0000-0x0000000005472000-memory.dmpFilesize
584KB
-
memory/2148-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmpFilesize
4KB
-
memory/2148-4-0x0000000002DB0000-0x0000000002DC2000-memory.dmpFilesize
72KB
-
memory/2148-5-0x0000000005510000-0x00000000055AC000-memory.dmpFilesize
624KB
-
memory/2148-6-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/2148-11-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/2148-2-0x0000000005AC0000-0x0000000006064000-memory.dmpFilesize
5.6MB
-
memory/2148-1-0x00000000008D0000-0x00000000009B6000-memory.dmpFilesize
920KB
-
memory/2384-16-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/2384-17-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/2384-18-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB