Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
14/10/2020, 15:22
General
- Target ORDER-20200912.doc............exe
- Size 379KB
- Sample201014-gz51naneqx
- SHA256 f2397e6357ab4351a130ce51fe8236c663b446bc8f414618890e45263460e6c7
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36:49746,2703,49714
-
word_6SI86kPnk
-
aes_key
cXaUSI4AZFOKx5k2667BdkKb6EfeIGtv
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
SEPT G88
-
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
word_6SI86kPnk
-
pastebin_config
null
-
port
49746,2703,49714
-
version
0.5.7B
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER-20200912.doc............exe"C:\Users\Admin\AppData\Local\Temp\ORDER-20200912.doc............exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/668-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/668-8-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/668-11-0x0000000009340000-0x0000000009341000-memory.dmp
memory/668-12-0x00000000098E0000-0x00000000098E1000-memory.dmp
memory/668-13-0x00000000093E0000-0x00000000093E1000-memory.dmp
memory/3024-0-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/3024-1-0x0000000000580000-0x0000000000581000-memory.dmp
memory/3024-3-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/3024-4-0x00000000051B0000-0x00000000051C3000-memory.dmp