Overview

overview

10

Static

static

10

ULTITECJOR...K9.exe

windows7_x64

10

ULTITECJOR...K9.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe

  • Size

    422KB

  • MD5

    0ada41553c85e51d2323a64add3ec6de

  • SHA1

    bef7bd18a545427bfb834e7650b02926e99181ab

  • SHA256

    6b09f1cfc05625cdd9c328e7ac8c67ade7fcc234cd0631999d8996b54c3da722

  • SHA512

    39c56c7fd174bbdf8cdb24c9cac8f0b5a9bf2415d85e0f5aacb82e86b0bdf3622bc1105ac5528f16db4553226052085144d9b258fbf180917e79d0bb63c2466e

Score
10/10
asyncratcoreentityratrezer0

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

185.165.153.215:6606

Mutex

uqeolevmck

Attributes
  • aes_key

    5eoiILw5GAY7OkbkZoi8uQvz2qpV60Nt

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    sunday

  • host

    185.165.153.215

  • hwid

    1

  • install_file

  • install_folder

    %AppData%

  • mutex

    uqeolevmck

  • pastebin_config

    null

  • port

    6606

  • version

    0.5.6D

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • Async RAT payload 4 IoCs
    rat
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
    "C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LDCESp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D13.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1732
    • C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
      "{path}"
      2⤵
        PID:1352

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp8D13.tmp
      MD5

      460627dcd6f03bb6d1ba0bae0f5a876b

      SHA1

      17a54db5eaa44620dec26bd8bc8d381b5714eac3

      SHA256

      0d1df856f46802538b9acd6481fc054985961acf5abfd1320f8a2bbaed3bb38d

      SHA512

      140fd40a675782f8e1fdcb1f062a6884c144ceefb3e1f3ca9fb587cebcef6a1ac634a2cd3ab38ec1898381d6c03267b7f75dd168f6ace436d1b5842eeae305ed

      Download Submit
    • memory/364-0-0x0000000073F40000-0x000000007462E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/364-1-0x00000000002F0000-0x00000000002F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/364-4-0x00000000004C0000-0x00000000004C3000-memory.dmp
      Filesize

      12KB

      Download
    • memory/364-5-0x0000000000620000-0x0000000000633000-memory.dmp
      Filesize

      76KB

      Download
    • memory/1352-8-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1352-9-0x000000000040C60E-mapping.dmp
      Download
    • memory/1352-10-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1352-11-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1352-12-0x0000000073F40000-0x000000007462E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1732-6-0x0000000000000000-mapping.dmp
      Download
    • memory/2004-3-0x000007FEF5BD0000-0x000007FEF5E4A000-memory.dmp
      Filesize

      2.5MB

      Download