Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:37
Behavioral task
behavioral1
Sample
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
Resource
win10v20201028
General
-
Target
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
-
Size
422KB
-
MD5
0ada41553c85e51d2323a64add3ec6de
-
SHA1
bef7bd18a545427bfb834e7650b02926e99181ab
-
SHA256
6b09f1cfc05625cdd9c328e7ac8c67ade7fcc234cd0631999d8996b54c3da722
-
SHA512
39c56c7fd174bbdf8cdb24c9cac8f0b5a9bf2415d85e0f5aacb82e86b0bdf3622bc1105ac5528f16db4553226052085144d9b258fbf180917e79d0bb63c2466e
Malware Config
Extracted
asyncrat
0.5.6D
185.165.153.215:6606
uqeolevmck
-
aes_key
5eoiILw5GAY7OkbkZoi8uQvz2qpV60Nt
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
sunday
-
host
185.165.153.215
-
hwid
1
- install_file
-
install_folder
%AppData%
-
mutex
uqeolevmck
-
pastebin_config
null
-
port
6606
-
version
0.5.6D
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral2/memory/4636-6-0x00000000043B0000-0x00000000043B3000-memory.dmp coreentity -
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2168-11-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2168-12-0x000000000040C60E-mapping.dmp asyncrat -
Processes:
resource yara_rule behavioral2/memory/4636-7-0x000000000A930000-0x000000000A943000-memory.dmp rezer0 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exedescription pid process target process PID 4636 set thread context of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exepid process 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exedescription pid process Token: SeDebugPrivilege 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exepid process 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exedescription pid process target process PID 4636 wrote to memory of 440 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe schtasks.exe PID 4636 wrote to memory of 440 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe schtasks.exe PID 4636 wrote to memory of 440 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe schtasks.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe PID 4636 wrote to memory of 2168 4636 ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe"C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LDCESp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B06.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ULTITECJORO8368Ngdkdvk0cCe8TdQhhzpOK9.exe.logMD5
b4f7a6a57cb46d94b72410eb6a6d45a9
SHA169f3596ffa027202d391444b769ceea0ae14c5f7
SHA25623994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b
SHA512be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c
-
C:\Users\Admin\AppData\Local\Temp\tmp5B06.tmpMD5
0d0ab56d8936ff894e452d51174369df
SHA1ea0949e92de9354fe94dec774aa48f6aa9b836f4
SHA256abb6d4dadf1994d102bd92faf9986edc1f1d5f2ed788aae0b87221fc14023dee
SHA5128a1da50c2ca6ede6c11fd5458e76e1752f59b48659b2f87377a0505c4778f7762a140dc3d3649e7a4a30d35d4942078014880aa6ce08c210def7c0e42c35e70c
-
memory/440-9-0x0000000000000000-mapping.dmp
-
memory/2168-14-0x0000000073D60000-0x000000007444E000-memory.dmpFilesize
6.9MB
-
memory/2168-12-0x000000000040C60E-mapping.dmp
-
memory/2168-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4636-4-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/4636-8-0x000000000AA00000-0x000000000AA01000-memory.dmpFilesize
4KB
-
memory/4636-7-0x000000000A930000-0x000000000A943000-memory.dmpFilesize
76KB
-
memory/4636-6-0x00000000043B0000-0x00000000043B3000-memory.dmpFilesize
12KB
-
memory/4636-5-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/4636-0-0x0000000073D60000-0x000000007444E000-memory.dmpFilesize
6.9MB
-
memory/4636-3-0x00000000072C0000-0x00000000072C1000-memory.dmpFilesize
4KB
-
memory/4636-1-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB