Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-12-2020 08:30
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Consignment Document PL&BL Draft.exe
-
Size
684KB
-
MD5
b70ffeb2babbacb28b22411beccb4642
-
SHA1
3c096e92894c9ff7bfae0fcc0ce5f250cb4ebe9f
-
SHA256
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
-
SHA512
79471594362dcb6f5ecbddb34ce68ddbbfc2320fa088439a54a0dfba7c878d32e5715366808b7a7399f33c9b992e6ebac75d90d9cdc5d591b42e480f4874db41
Malware Config
Extracted
nanocore
1.2.2.0
:5550
centurygift.myq-see.com:5550
a60f1e04-b281-49b0-9733-22b28c2ea6d7
-
activate_away_mode
true
-
backup_connection_host
centurygift.myq-see.com
-
backup_dns_server
centurygift.myq-see.com
-
buffer_size
65535
-
build_time
2020-09-08T01:46:57.095018036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5550
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a60f1e04-b281-49b0-9733-22b28c2ea6d7
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
centurygift.myq-see.com
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
asyncrat
0.5.7B
centurygift.myq-see.com:5500
AsyncMutex_6SI8OkPnk
-
aes_key
bWbB4qsIdUz0RazB3LzXObRAUS2SpbLy
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
centurygift.myq-see.com
-
hwid
3
- install_file
-
install_folder
%Temp%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
5500
-
version
0.5.7B
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe asyncrat C:\Users\Admin\AppData\Local\Temp\VLC2.exe asyncrat C:\Users\Admin\AppData\Local\Temp\VLC2.exe asyncrat -
Executes dropped EXE 5 IoCs
Processes:
Rczgwoxvqzh.exeIcda.exeIsgeprf.exeFdquqwatjjr.exeVLC2.exepid process 2756 Rczgwoxvqzh.exe 3852 Icda.exe 1228 Isgeprf.exe 1080 Fdquqwatjjr.exe 200 VLC2.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Icda.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Manager = "C:\\Program Files (x86)\\SMTP Manager\\smtpmgr.exe" Icda.exe -
Processes:
Icda.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Icda.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Consignment Document PL&BL Draft.exedescription pid process target process PID 1404 set thread context of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Icda.exedescription ioc process File opened for modification C:\Program Files (x86)\SMTP Manager\smtpmgr.exe Icda.exe File created C:\Program Files (x86)\SMTP Manager\smtpmgr.exe Icda.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3944 timeout.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Fdquqwatjjr.exeIcda.exeIsgeprf.exepid process 1080 Fdquqwatjjr.exe 1080 Fdquqwatjjr.exe 3852 Icda.exe 3852 Icda.exe 3852 Icda.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe 1228 Isgeprf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Icda.exepid process 3852 Icda.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Fdquqwatjjr.exeIcda.exeIsgeprf.exeVLC2.exedescription pid process Token: SeDebugPrivilege 1080 Fdquqwatjjr.exe Token: SeDebugPrivilege 3852 Icda.exe Token: SeDebugPrivilege 1228 Isgeprf.exe Token: SeDebugPrivilege 200 VLC2.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exeRczgwoxvqzh.exeIsgeprf.execmd.execmd.exedescription pid process target process PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1404 wrote to memory of 1172 1404 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1172 wrote to memory of 2756 1172 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 1172 wrote to memory of 2756 1172 Consignment Document PL&BL Draft.exe Rczgwoxvqzh.exe PID 1172 wrote to memory of 3852 1172 Consignment Document PL&BL Draft.exe Icda.exe PID 1172 wrote to memory of 3852 1172 Consignment Document PL&BL Draft.exe Icda.exe PID 1172 wrote to memory of 3852 1172 Consignment Document PL&BL Draft.exe Icda.exe PID 2756 wrote to memory of 1228 2756 Rczgwoxvqzh.exe Isgeprf.exe PID 2756 wrote to memory of 1228 2756 Rczgwoxvqzh.exe Isgeprf.exe PID 2756 wrote to memory of 1228 2756 Rczgwoxvqzh.exe Isgeprf.exe PID 2756 wrote to memory of 1080 2756 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 2756 wrote to memory of 1080 2756 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 2756 wrote to memory of 1080 2756 Rczgwoxvqzh.exe Fdquqwatjjr.exe PID 1228 wrote to memory of 1576 1228 Isgeprf.exe cmd.exe PID 1228 wrote to memory of 1576 1228 Isgeprf.exe cmd.exe PID 1228 wrote to memory of 1576 1228 Isgeprf.exe cmd.exe PID 1228 wrote to memory of 1008 1228 Isgeprf.exe cmd.exe PID 1228 wrote to memory of 1008 1228 Isgeprf.exe cmd.exe PID 1228 wrote to memory of 1008 1228 Isgeprf.exe cmd.exe PID 1576 wrote to memory of 3828 1576 cmd.exe schtasks.exe PID 1576 wrote to memory of 3828 1576 cmd.exe schtasks.exe PID 1576 wrote to memory of 3828 1576 cmd.exe schtasks.exe PID 1008 wrote to memory of 3944 1008 cmd.exe timeout.exe PID 1008 wrote to memory of 3944 1008 cmd.exe timeout.exe PID 1008 wrote to memory of 3944 1008 cmd.exe timeout.exe PID 1008 wrote to memory of 200 1008 cmd.exe VLC2.exe PID 1008 wrote to memory of 200 1008 cmd.exe VLC2.exe PID 1008 wrote to memory of 200 1008 cmd.exe VLC2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exe"C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe"C:\Users\Admin\AppData\Local\Temp\Isgeprf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VLC2" /tr '"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "VLC2" /tr '"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp64E5.tmp.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exe"C:\Users\Admin\AppData\Local\Temp\VLC2.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exe"C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Icda.exe"C:\Users\Admin\AppData\Local\Temp\Icda.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Consignment Document PL&BL Draft.exe.logMD5
3fed8d1dd11972a6e2603bb2d73a3ee5
SHA17ecb7f64ade7b91c5815da647e84167c3d95afb4
SHA256eecf6c0575dc995a485d46a5daaa66f58229e552f16782d873834d218ab17551
SHA512ca6059eb67f800cc666d5146d24070abf5ee08209f8f9d1668a0ca2201eb3f6fa013c2d807b09925e12b82c37686980fcc26a6a5e4a5ba129c4b2a585961d3bb
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exeMD5
e8dc83a4ed7657d3211077b7f343fc3c
SHA10af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
SHA256c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
SHA512f37155be17e744b46cb76f746ec8d02e7d6f0ec8b3d8caa583081504e15674b9c1bb5e3061b149aeb599325293959704064b3512f156797c1f5046289e41125c
-
C:\Users\Admin\AppData\Local\Temp\Fdquqwatjjr.exeMD5
e8dc83a4ed7657d3211077b7f343fc3c
SHA10af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
SHA256c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
SHA512f37155be17e744b46cb76f746ec8d02e7d6f0ec8b3d8caa583081504e15674b9c1bb5e3061b149aeb599325293959704064b3512f156797c1f5046289e41125c
-
C:\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
C:\Users\Admin\AppData\Local\Temp\Icda.exeMD5
bb21f995740d8bc1549d9cbc32874dd8
SHA18c53b645027362ec97c15735eeb39a12d62c8a74
SHA2569589565f7beb6dccfe4f8424455271bbf810182ea94dacbc8c081577e34a51e1
SHA512608e1871476d3534d9c7bc1951ccc4abbb3056f57d3c64beb1d13b8a453de7b113001c70c0a1728a2776538d464893990a88035b2fb34254f24927e4536ae24b
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\Isgeprf.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exeMD5
01475371c9519a0c8f64b7606a0833e0
SHA158de8246d2910f00ed1d4deabc69cf60d8ddcf8b
SHA25697a5cab2336f3b81f82d7ec85b2f0937ce39d10e512bf0bdade9248d6d1bc682
SHA5129db9f3d2f6db0e1e7154d79b54316a0a54d75bdab327ec248d23f7eed3db54bb00c61c003c92e1b1c38d30eefa6a680cba73b7cf28de3c2181bb82b25e40662f
-
C:\Users\Admin\AppData\Local\Temp\Rczgwoxvqzh.exeMD5
01475371c9519a0c8f64b7606a0833e0
SHA158de8246d2910f00ed1d4deabc69cf60d8ddcf8b
SHA25697a5cab2336f3b81f82d7ec85b2f0937ce39d10e512bf0bdade9248d6d1bc682
SHA5129db9f3d2f6db0e1e7154d79b54316a0a54d75bdab327ec248d23f7eed3db54bb00c61c003c92e1b1c38d30eefa6a680cba73b7cf28de3c2181bb82b25e40662f
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\VLC2.exeMD5
e2da4f42475e01f7961ef2fb929de54e
SHA1e57df765da7135d578b29e4619cc395a729eb757
SHA256488c59fddf2db00da7fb4d6589183adc7396edc4233f23eb950aa7191fe4366e
SHA51208cf988be2b1d4214812477759bf273e1281d762491d5eb40ed77c95ad701a08fce0d5a67b7d2163389e0efa96422dd535d1062ecb345ac6054688e38eb6e2a0
-
C:\Users\Admin\AppData\Local\Temp\tmp64E5.tmp.batMD5
13d072b787c9e6982b18aba972971900
SHA19013fbfa37c5c15d4ce18233b81b441068e8e5ce
SHA25661dcb96e03332af93eeebc05d3fe1f75315cc5373dd77f1a574932d42dac1ca1
SHA5122c8bc9d595f51bba9c9e122f94e953f6f298a0cb7ae617a989b43fb6752aeabeebf3ecec5a1d563cd653f7f9caf3851614278bac2cb10c5ee6450e468617a62a
-
memory/200-52-0x0000000000000000-mapping.dmp
-
memory/200-53-0x0000000000000000-mapping.dmp
-
memory/200-56-0x0000000071C10000-0x00000000722FE000-memory.dmpFilesize
6.9MB
-
memory/1008-46-0x0000000000000000-mapping.dmp
-
memory/1080-32-0x0000000000000000-mapping.dmp
-
memory/1080-40-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1080-38-0x0000000071C10000-0x00000000722FE000-memory.dmpFilesize
6.9MB
-
memory/1080-50-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/1080-51-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/1172-13-0x00000000004487CE-mapping.dmp
-
memory/1172-15-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1172-12-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1228-30-0x0000000000000000-mapping.dmp
-
memory/1228-34-0x0000000071C10000-0x00000000722FE000-memory.dmpFilesize
6.9MB
-
memory/1228-37-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1404-9-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/1404-10-0x0000000005920000-0x000000000592E000-memory.dmpFilesize
56KB
-
memory/1404-3-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/1404-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1404-5-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/1404-6-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/1404-7-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/1404-11-0x0000000007240000-0x00000000072BD000-memory.dmpFilesize
500KB
-
memory/1404-8-0x0000000007DE0000-0x0000000007DE1000-memory.dmpFilesize
4KB
-
memory/1576-45-0x0000000000000000-mapping.dmp
-
memory/2756-28-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2756-25-0x00007FFB59970000-0x00007FFB5A35C000-memory.dmpFilesize
9.9MB
-
memory/2756-21-0x0000000000000000-mapping.dmp
-
memory/3828-48-0x0000000000000000-mapping.dmp
-
memory/3852-24-0x0000000000000000-mapping.dmp
-
memory/3944-49-0x0000000000000000-mapping.dmp