Analysis
- max time kernel
77s - max time network
149s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 15:22
General
- Target ORDER-20200912.doc............exe
- Size 379KB
- Sample201014-gz51naneqx
- SHA256 f2397e6357ab4351a130ce51fe8236c663b446bc8f414618890e45263460e6c7
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36:49746,2703,49714
-
word_6SI86kPnk
-
aes_key
cXaUSI4AZFOKx5k2667BdkKb6EfeIGtv
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
SEPT G88
-
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
word_6SI86kPnk
-
pastebin_config
null
-
port
49746,2703,49714
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 4 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER-20200912.doc............exe"C:\Users\Admin\AppData\Local\Temp\ORDER-20200912.doc............exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-5-0x0000000000400000-0x0000000000412000-memory.dmp
memory/848-7-0x0000000000400000-0x0000000000412000-memory.dmp
memory/848-8-0x0000000000400000-0x0000000000412000-memory.dmp
memory/848-9-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/1620-0-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/1620-1-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/1620-3-0x00000000009D0000-0x00000000009E3000-memory.dmp