Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-12-2020 08:30
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Consignment Document PL&BL Draft.exe
-
Size
684KB
-
MD5
b70ffeb2babbacb28b22411beccb4642
-
SHA1
3c096e92894c9ff7bfae0fcc0ce5f250cb4ebe9f
-
SHA256
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
-
SHA512
79471594362dcb6f5ecbddb34ce68ddbbfc2320fa088439a54a0dfba7c878d32e5715366808b7a7399f33c9b992e6ebac75d90d9cdc5d591b42e480f4874db41
Malware Config
Extracted
nanocore
1.2.2.0
:5550
centurygift.myq-see.com:5550
a60f1e04-b281-49b0-9733-22b28c2ea6d7
-
activate_away_mode
true
-
backup_connection_host
centurygift.myq-see.com
-
backup_dns_server
centurygift.myq-see.com
-
buffer_size
65535
-
build_time
2020-09-08T01:46:57.095018036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5550
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a60f1e04-b281-49b0-9733-22b28c2ea6d7
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
centurygift.myq-see.com
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
asyncrat
0.5.7B
centurygift.myq-see.com:5500
AsyncMutex_6SI8OkPnk
-
aes_key
bWbB4qsIdUz0RazB3LzXObRAUS2SpbLy
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
centurygift.myq-see.com
-
hwid
3
- install_file
-
install_folder
%Temp%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
5500
-
version
0.5.7B
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe asyncrat \Users\Admin\AppData\Local\Temp\VLC2.exe asyncrat C:\Users\Admin\AppData\Local\Temp\VLC2.exe asyncrat C:\Users\Admin\AppData\Local\Temp\VLC2.exe asyncrat -
Executes dropped EXE 5 IoCs
Processes:
Rczgwoxvqzh.exeIcda.exeIsgeprf.exeFdquqwatjjr.exeVLC2.exepid process 620 Rczgwoxvqzh.exe 1744 Icda.exe 1540 Isgeprf.exe 572 Fdquqwatjjr.exe 336 VLC2.exe -
Loads dropped DLL 4 IoCs
Processes:
Consignment Document PL&BL Draft.execmd.exepid process 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 1976 cmd.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Icda.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Host = "C:\\Program Files (x86)\\WPA Host\\wpahost.exe" Icda.exe -
Processes:
Icda.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Icda.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Consignment Document PL&BL Draft.exedescription pid process target process PID 1068 set thread context of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Icda.exedescription ioc process File created C:\Program Files (x86)\WPA Host\wpahost.exe Icda.exe File opened for modification C:\Program Files (x86)\WPA Host\wpahost.exe Icda.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2012 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Icda.exeFdquqwatjjr.exeIsgeprf.exepid process 1744 Icda.exe 1744 Icda.exe 1744 Icda.exe 572 Fdquqwatjjr.exe 572 Fdquqwatjjr.exe 1540 Isgeprf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Icda.exepid process 1744 Icda.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Icda.exeFdquqwatjjr.exeIsgeprf.exeVLC2.exedescription pid process Token: SeDebugPrivilege 1744 Icda.exe Token: SeDebugPrivilege 572 Fdquqwatjjr.exe Token: SeDebugPrivilege 1540 Isgeprf.exe Token: SeDebugPrivilege 336 VLC2.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exeRczgwoxvqzh.exeIsgeprf.execmd.execmd.exedescription pid process target process PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1068 wrote to memory of 2008 1068 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 2008 wrote to memory of 620 2008 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 2008 wrote to memory of 620 2008 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 2008 wrote to memory of 620 2008 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 2008 wrote to memory of 620 2008 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 2008 wrote to memory of 1744 2008 Consignment Document PL&BL Draft.exe Icda.exe PID 2008 wrote to memory of 1744 2008 Consignment Document PL&BL Draft.exe Icda.exe PID 2008 wrote to memory of 1744 2008 Consignment Document PL&BL Draft.exe Icda.exe PID 2008 wrote to memory of 1744 2008 Consignment Document PL&BL Draft.exe Icda.exe PID 620 wrote to memory of 1540 620 Rczgwoxvqzh.exe Isgeprf.exe PID 620 wrote to memory of 1540 620 Rczgwoxvqzh.exe Isgeprf.exe PID 620 wrote to memory of 1540 620 Rczgwoxvqzh.exe Isgeprf.exe PID 620 wrote to memory of 1540 620 Rczgwoxvqzh.exe Isgeprf.exe PID 620 wrote to memory of 572 620 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 620 wrote to memory of 572 620 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 620 wrote to memory of 572 620 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 620 wrote to memory of 572 620 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 1540 wrote to memory of 800 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 800 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 800 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 800 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 1976 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 1976 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 1976 1540 Isgeprf.exe cmd.exe PID 1540 wrote to memory of 1976 1540 Isgeprf.exe cmd.exe PID 800 wrote to memory of 1908 800 cmd.exe schtasks.exe PID 800 wrote to memory of 1908 800 cmd.exe schtasks.exe PID 800 wrote to memory of 1908 800 cmd.exe schtasks.exe PID 800 wrote to memory of 1908 800 cmd.exe schtasks.exe PID 1976 wrote to memory of 2012 1976 cmd.exe timeout.exe PID 1976 wrote to memory of 2012 1976 cmd.exe timeout.exe PID 1976 wrote to memory of 2012 1976 cmd.exe timeout.exe PID 1976 wrote to memory of 2012 1976 cmd.exe timeout.exe PID 1976 wrote to memory of 336 1976 cmd.exe VLC2.exe PID 1976 wrote to memory of 336 1976 cmd.exe VLC2.exe PID 1976 wrote to memory of 336 1976 cmd.exe VLC2.exe PID 1976 wrote to memory of 336 1976 cmd.exe VLC2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exe"C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe"C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VLC2" /tr '"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "VLC2" /tr '"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD72D.tmp.bat""5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exe"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exe"C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Icda.exe"C:\Users\Admin\AppData\Local\Temp\Icda.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exeMD5
e8dc83a4ed7657d3211077b7f343fc3c
SHA10af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
SHA256c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
SHA512f37155be17e744b46cb76f746ec8d02e7d6f0ec8b3d8caa583081504e15674b9c1bb5e3061b149aeb599325293959704064b3512f156797c1f5046289e41125c
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exeMD5
e8dc83a4ed7657d3211077b7f343fc3c
SHA10af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
SHA256c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
SHA512f37155be17e744b46cb76f746ec8d02e7d6f0ec8b3d8caa583081504e15674b9c1bb5e3061b149aeb599325293959704064b3512f156797c1f5046289e41125c
-
C:\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
C:\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exeMD5
01475371c9519a0c8f64b7606a0833e0
SHA158de8246d2910f00ed1d4deabc69cf60d8ddcf8b
SHA25697a5cab2336f3b81f82d7ec85b2f0937ce39d10e512bf0bdade9248d6d1bc682
SHA5129db9f3d2f6db0e1e7154d79b54316a0a54d75bdab327ec248d23f7eed3db54bb00c61c003c92e1b1c38d30eefa6a680cba73b7cf28de3c2181bb82b25e40662f
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exeMD5
01475371c9519a0c8f64b7606a0833e0
SHA158de8246d2910f00ed1d4deabc69cf60d8ddcf8b
SHA25697a5cab2336f3b81f82d7ec85b2f0937ce39d10e512bf0bdade9248d6d1bc682
SHA5129db9f3d2f6db0e1e7154d79b54316a0a54d75bdab327ec248d23f7eed3db54bb00c61c003c92e1b1c38d30eefa6a680cba73b7cf28de3c2181bb82b25e40662f
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\tmpD72D.tmp.batMD5
99f9da2623b6adf75ca7525de511b803
SHA127060e6e224d3059804020e07e05a9bb5c670079
SHA25681bda631224eef2451ca549cd3718b4cb9a276a658d64b9afedb61a83172d273
SHA51216ed9934fcc8e4c08e0ccc1ce275bccad8855bb231fc1e7b0c2a12e916e557d03242007e9b66ef95a89ea4c15144ae5d3892ab3b3e48d0ecf50be54503d4b16f
-
\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exeMD5
01475371c9519a0c8f64b7606a0833e0
SHA158de8246d2910f00ed1d4deabc69cf60d8ddcf8b
SHA25697a5cab2336f3b81f82d7ec85b2f0937ce39d10e512bf0bdade9248d6d1bc682
SHA5129db9f3d2f6db0e1e7154d79b54316a0a54d75bdab327ec248d23f7eed3db54bb00c61c003c92e1b1c38d30eefa6a680cba73b7cf28de3c2181bb82b25e40662f
-
\Users\Admin\AppData\Local\Temp\VLC2.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
memory/336-48-0x0000000072FC0000-0x00000000736AE000-memory.dmpFilesize
6.9MB
-
memory/336-45-0x0000000000000000-mapping.dmp
-
memory/336-47-0x0000000000000000-mapping.dmp
-
memory/336-49-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/572-34-0x0000000072FC0000-0x00000000736AE000-memory.dmpFilesize
6.9MB
-
memory/572-36-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/572-29-0x0000000000000000-mapping.dmp
-
memory/620-15-0x0000000000000000-mapping.dmp
-
memory/620-21-0x000007FEF5D30000-0x000007FEF671C000-memory.dmpFilesize
9.9MB
-
memory/620-24-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/800-38-0x0000000000000000-mapping.dmp
-
memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/1068-3-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/1068-5-0x00000000002E0000-0x00000000002EE000-memory.dmpFilesize
56KB
-
memory/1068-6-0x00000000057D0000-0x000000000584D000-memory.dmpFilesize
500KB
-
memory/1540-30-0x0000000072FC0000-0x00000000736AE000-memory.dmpFilesize
6.9MB
-
memory/1540-26-0x0000000000000000-mapping.dmp
-
memory/1540-32-0x0000000001160000-0x0000000001161000-memory.dmpFilesize
4KB
-
memory/1744-20-0x0000000000000000-mapping.dmp
-
memory/1908-41-0x0000000000000000-mapping.dmp
-
memory/1976-39-0x0000000000000000-mapping.dmp
-
memory/2008-7-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2008-8-0x00000000004487CE-mapping.dmp
-
memory/2008-9-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2008-10-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2008-11-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/2012-42-0x0000000000000000-mapping.dmp