Analysis
- max time kernel
149s - max time network
138s - platform
windows10_x64 - resource
win10v200722 - submitted
12/08/2020, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe
- Size 412KB
- Sample200812-9ebg9lf316
- SHA256 f48839422ba1f64d6fa4de03c68e1fcb254fc079fa1c971dc6e6dad523a4561a
- MD5 8bba21852f3a21b7fb76ab9461a3809f
- SHA1 5cb8f0a988a89418cb9cf779590c7c81fd66a3d2
- SHA512 f375ce31c60897c030ef7ddfc6883e0d368ce8b339c550c4a4ede70cae7aa2d55d7429f11716b3f1b1515e3394d2794b49427610b6cc359d6a041b5a687647b4
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7A
C2
-
79.134.225.78:5007
Mutex
-
hjuy
Attributes
-
aes_key
RAiS227L1qG6wfXzS6CcU093QircVNZ3
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
79.134.225.78
-
hwid
1
- install_file
-
install_folder
%AppData%
-
mutex
hjuy
-
pastebin_config
null
-
port
5007
-
version
0.5.7A
aes.plain
Signatures
- Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/3056-3-0x0000000002F30000-0x0000000002F40000-memory.dmp asyncrat behavioral2/memory/576-5-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/576-6-0x000000000040C5BE-mapping.dmp asyncrat - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3056 set thread context of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 - Suspicious behavior: EnumeratesProcesses 136 IoCs
pid Process 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe Token: SeDebugPrivilege 576 caspol.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67 PID 3056 wrote to memory of 576 3056 NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER ENQUIRY AND PROCUREMENT DATASHEET OHMEX INTERNATIONAL_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
-