Analysis
-
max time kernel
13s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-12-2020 17:06
Static task
static1
Behavioral task
behavioral1
Sample
BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe
Resource
win7v20201028
General
-
Target
BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe
-
Size
321KB
-
MD5
24b6a2657a73c3bad64be3b3eadc5ecd
-
SHA1
5f35c84e24163264be7ccb807d8121695c3b1c4d
-
SHA256
cdbadb90de6d5cbdd15f273917be1ba0a17142aa84b3196becafb5c670ec5d28
-
SHA512
55a820b8fa4be1a8313c5ec9d33ab5314635d98428141c52ab62f49441fbf755832ddacf2ec7455c266893fb716803afe319ae5fc9d845055cf97a0d401a74ea
Malware Config
Extracted
asyncrat
0.5.7B
sdfsdfasdf.duckdns.org:8050
AsyncMutex_6SI8OkPnk
-
aes_key
MHVDLkAAZAe6m0lVK86hB1WGVmtSHDdM
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
sdfsdfasdf.duckdns.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
8050
-
version
0.5.7B
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4760-6-0x00000000031F0000-0x00000000031FC000-memory.dmp asyncrat -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exedescription pid process Token: SeDebugPrivilege 4760 BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.execmd.exedescription pid process target process PID 4760 wrote to memory of 5072 4760 BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe cmd.exe PID 4760 wrote to memory of 5072 4760 BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe cmd.exe PID 4760 wrote to memory of 5072 4760 BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe cmd.exe PID 5072 wrote to memory of 3624 5072 cmd.exe schtasks.exe PID 5072 wrote to memory of 3624 5072 cmd.exe schtasks.exe PID 5072 wrote to memory of 3624 5072 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe"C:\Users\Admin\AppData\Local\Temp\BANCOLOMBIA LE INFORMA QUE SU CUENTA DE AHORRO ESTA PRESENTANDO MOVIVIMIENTOS INUSUALES VALIDE SU IN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN explorer.exe /XML "C:\Users\Admin\AppData\Local\Temp\a2c3156a75534383bff0c301114bc906.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN explorer.exe /XML "C:\Users\Admin\AppData\Local\Temp\a2c3156a75534383bff0c301114bc906.xml"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a2c3156a75534383bff0c301114bc906.xmlMD5
a28273fe33db8fdc1750e4ee81a096a6
SHA1105b8a092e4b32ad2d1d55179c3c7ca4b9259273
SHA256b2b5089415edc1412fd52630ac863e1842fb3d172fa6e14973a0c63eb87c14b5
SHA51297f09bc288d2ce396c0ee17f90624e310f21e348c06b6bc9544b193fecf7949879add2b919d120738bee5f3d779789e3418510891d4bea8695d8209710ae31b3
-
memory/3624-4-0x0000000000000000-mapping.dmp
-
memory/4760-3-0x0000000072C60000-0x000000007334E000-memory.dmpFilesize
6.9MB
-
memory/4760-6-0x00000000031F0000-0x00000000031FC000-memory.dmpFilesize
48KB
-
memory/4760-8-0x0000000006370000-0x0000000006371000-memory.dmpFilesize
4KB
-
memory/4760-9-0x0000000006910000-0x0000000006911000-memory.dmpFilesize
4KB
-
memory/4760-10-0x0000000006410000-0x0000000006411000-memory.dmpFilesize
4KB
-
memory/5072-2-0x0000000000000000-mapping.dmp