Analysis
- max time kernel
151s - max time network
152s - platform
windows7_x64 - resource
win7v200722 - submitted
18/08/2020, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE CHNR000076498 AUG 2020.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE CHNR000076498 AUG 2020.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target INVOICE CHNR000076498 AUG 2020.exe
- Size 153KB
- Sample200818-2es5rd8kja
- SHA256 02dd12ec33f4f1d1bbf4f3479ad5bc88be2a1c92f19461e6f25a754e213abc42
- MD5 73a72a5968b558d7c6d270445e5c25bc
- SHA1 6653542b2204dd4964619b06ee466c1096abe76c
- SHA512 0f3a5a0ee1907d2bce9dc3dccc7a8afa97f2da33c2291ea5df19bceac145aac514d604ec6704dcea6c1a48058a9651afa115ce58012e7462fe16f83e129890c3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7A
C2
-
185.165.153.43:5007
Mutex
-
hjuy
Attributes
-
aes_key
PY5bOpRKvEbXLgdX8vdBKaQGsPpzPp09
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
185.165.153.43
-
hwid
1
- install_file
-
install_folder
%AppData%
-
mutex
hjuy
-
pastebin_config
null
-
port
5007
-
version
0.5.7A
aes.plain
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\INVOICE CHNR000076498 AUG 2020.exe\"" INVOICE CHNR000076498 AUG 2020.exe - Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/112-2-0x0000000000660000-0x0000000000691000-memory.dmp asyncrat behavioral1/memory/288-3-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/288-4-0x000000000040C5AE-mapping.dmp asyncrat behavioral1/memory/288-5-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/288-6-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INVOICE CHNR000076498 AUG 2020.exe INVOICE CHNR000076498 AUG 2020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INVOICE CHNR000076498 AUG 2020.exe INVOICE CHNR000076498 AUG 2020.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\INVOICE CHNR000076498 AUG 2020.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\INVOICE CHNR000076498 AUG 2020.exe" INVOICE CHNR000076498 AUG 2020.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 112 set thread context of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 - Suspicious behavior: EnumeratesProcesses 74 IoCs
pid Process 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe 112 INVOICE CHNR000076498 AUG 2020.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 112 INVOICE CHNR000076498 AUG 2020.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24 PID 112 wrote to memory of 288 112 INVOICE CHNR000076498 AUG 2020.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE CHNR000076498 AUG 2020.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE CHNR000076498 AUG 2020.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵PID:288
-