Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-01-2021 20:07
Static task
static1
Behavioral task
behavioral1
Sample
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
Resource
win7v20201028
General
-
Target
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
-
Size
1.0MB
-
MD5
2596a24f0668203076e4829fa72dcfe7
-
SHA1
6d47cd0fa430e89e98931c487a179de58b943521
-
SHA256
009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
-
SHA512
267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
Malware Config
Extracted
asyncrat
0.5.7B
productos.linkpc.net:3470
AsyncMutex_6SI8OkPnk
-
aes_key
cRDJUz3TELGT8tZPsxRbzbKFZunEqWvB
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
productos.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
3470
-
version
0.5.7B
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-10-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2016-11-0x000000000040C76E-mapping.dmp asyncrat behavioral1/memory/2016-12-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2016-13-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1608-36-0x000000000040C76E-mapping.dmp asyncrat behavioral1/memory/1608-38-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1608-39-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1608-43-0x0000000000730000-0x000000000074B000-memory.dmp asyncrat -
Executes dropped EXE 3 IoCs
Processes:
dllwindefenderp.exedllwindefenderp.exewsimth.exepid process 1920 dllwindefenderp.exe 1608 dllwindefenderp.exe 1472 wsimth.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepowershell.exepid process 920 cmd.exe 240 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedescription pid process target process PID 2024 set thread context of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 1920 set thread context of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1556 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepowershell.exedllwindefenderp.exepid process 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 240 powershell.exe 1608 dllwindefenderp.exe 240 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exepowershell.exedescription pid process Token: SeDebugPrivilege 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe Token: SeDebugPrivilege 1608 dllwindefenderp.exe Token: SeDebugPrivilege 240 powershell.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.execmd.execmd.exedllwindefenderp.exedllwindefenderp.execmd.exepowershell.exedescription pid process target process PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2024 wrote to memory of 2016 2024 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2016 wrote to memory of 368 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 368 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 368 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 368 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 920 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 920 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 920 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2016 wrote to memory of 920 2016 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 368 wrote to memory of 1064 368 cmd.exe schtasks.exe PID 368 wrote to memory of 1064 368 cmd.exe schtasks.exe PID 368 wrote to memory of 1064 368 cmd.exe schtasks.exe PID 368 wrote to memory of 1064 368 cmd.exe schtasks.exe PID 920 wrote to memory of 1556 920 cmd.exe timeout.exe PID 920 wrote to memory of 1556 920 cmd.exe timeout.exe PID 920 wrote to memory of 1556 920 cmd.exe timeout.exe PID 920 wrote to memory of 1556 920 cmd.exe timeout.exe PID 920 wrote to memory of 1920 920 cmd.exe dllwindefenderp.exe PID 920 wrote to memory of 1920 920 cmd.exe dllwindefenderp.exe PID 920 wrote to memory of 1920 920 cmd.exe dllwindefenderp.exe PID 920 wrote to memory of 1920 920 cmd.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1920 wrote to memory of 1608 1920 dllwindefenderp.exe dllwindefenderp.exe PID 1608 wrote to memory of 1512 1608 dllwindefenderp.exe cmd.exe PID 1608 wrote to memory of 1512 1608 dllwindefenderp.exe cmd.exe PID 1608 wrote to memory of 1512 1608 dllwindefenderp.exe cmd.exe PID 1608 wrote to memory of 1512 1608 dllwindefenderp.exe cmd.exe PID 1512 wrote to memory of 240 1512 cmd.exe powershell.exe PID 1512 wrote to memory of 240 1512 cmd.exe powershell.exe PID 1512 wrote to memory of 240 1512 cmd.exe powershell.exe PID 1512 wrote to memory of 240 1512 cmd.exe powershell.exe PID 240 wrote to memory of 1472 240 powershell.exe wsimth.exe PID 240 wrote to memory of 1472 240 powershell.exe wsimth.exe PID 240 wrote to memory of 1472 240 powershell.exe wsimth.exe PID 240 wrote to memory of 1472 240 powershell.exe wsimth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF2D7.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wsimth.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wsimth.exe"'7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wsimth.exe"C:\Users\Admin\AppData\Local\Temp\wsimth.exe"8⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF2D7.tmp.batMD5
42d2415e4b42bba584578d0f6079f278
SHA1ad6a3bc746f1da8e0f6cf82a9670ea90afbe0e6d
SHA256c3d0729a1d8cc59ba45c7bb9bf3bb63b08d71e0696cd6e2e919be8009cb4f84d
SHA5122867a3a3e21b3dacae7412eb61142d94dc4f19d99871e702d1a0af3308b7182a5efbfb6a20bdfd138bb24f7720cc458912c6b609d53c904c074fc047aa0dfe43
-
C:\Users\Admin\AppData\Local\Temp\wsimth.exeMD5
9216769b1d4d22bab2f52286af332d9a
SHA1571211c7e9b0756f7ad37b4caf635a598dc7187f
SHA2569f0d41153879ec3295eb9e98efcecb25922500fd950c3a2d7d7990d98505396c
SHA512a5625fb9c77e3c80bb31fb0ce3fb4a070882403a43aa66cdb4eb2ac5cc28a6399b592833901bf599d6573cd106d0e220a7d25218d6be0ddb4f3637f4a47c6255
-
C:\Users\Admin\AppData\Local\Temp\wsimth.exeMD5
9216769b1d4d22bab2f52286af332d9a
SHA1571211c7e9b0756f7ad37b4caf635a598dc7187f
SHA2569f0d41153879ec3295eb9e98efcecb25922500fd950c3a2d7d7990d98505396c
SHA512a5625fb9c77e3c80bb31fb0ce3fb4a070882403a43aa66cdb4eb2ac5cc28a6399b592833901bf599d6573cd106d0e220a7d25218d6be0ddb4f3637f4a47c6255
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
\Users\Admin\AppData\Local\Temp\wsimth.exeMD5
9216769b1d4d22bab2f52286af332d9a
SHA1571211c7e9b0756f7ad37b4caf635a598dc7187f
SHA2569f0d41153879ec3295eb9e98efcecb25922500fd950c3a2d7d7990d98505396c
SHA512a5625fb9c77e3c80bb31fb0ce3fb4a070882403a43aa66cdb4eb2ac5cc28a6399b592833901bf599d6573cd106d0e220a7d25218d6be0ddb4f3637f4a47c6255
-
\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
memory/240-49-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/240-50-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/240-51-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/240-48-0x00000000020F0000-0x00000000020F1000-memory.dmpFilesize
4KB
-
memory/240-54-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/240-47-0x0000000073500000-0x0000000073BEE000-memory.dmpFilesize
6.9MB
-
memory/240-45-0x0000000000000000-mapping.dmp
-
memory/240-59-0x00000000060B0000-0x00000000060B1000-memory.dmpFilesize
4KB
-
memory/240-46-0x0000000000000000-mapping.dmp
-
memory/240-60-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/240-67-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/368-17-0x0000000000000000-mapping.dmp
-
memory/920-18-0x0000000000000000-mapping.dmp
-
memory/1064-20-0x0000000000000000-mapping.dmp
-
memory/1472-72-0x0000000073500000-0x0000000073BEE000-memory.dmpFilesize
6.9MB
-
memory/1472-73-0x0000000001060000-0x0000000001061000-memory.dmpFilesize
4KB
-
memory/1472-75-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1472-70-0x0000000000000000-mapping.dmp
-
memory/1512-44-0x0000000000000000-mapping.dmp
-
memory/1556-21-0x0000000000000000-mapping.dmp
-
memory/1608-39-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-43-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/1608-40-0x0000000073500000-0x0000000073BEE000-memory.dmpFilesize
6.9MB
-
memory/1608-38-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-79-0x0000000006280000-0x00000000062D9000-memory.dmpFilesize
356KB
-
memory/1608-78-0x0000000005140000-0x00000000051CD000-memory.dmpFilesize
564KB
-
memory/1608-77-0x0000000004590000-0x0000000004594000-memory.dmpFilesize
16KB
-
memory/1608-76-0x0000000005C40000-0x0000000005CB9000-memory.dmpFilesize
484KB
-
memory/1608-36-0x000000000040C76E-mapping.dmp
-
memory/1920-24-0x0000000000000000-mapping.dmp
-
memory/1920-27-0x0000000073500000-0x0000000073BEE000-memory.dmpFilesize
6.9MB
-
memory/1920-25-0x0000000000000000-mapping.dmp
-
memory/1920-28-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/2016-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2016-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2016-11-0x000000000040C76E-mapping.dmp
-
memory/2016-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2016-14-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/2024-5-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/2024-6-0x0000000005350000-0x00000000053DA000-memory.dmpFilesize
552KB
-
memory/2024-3-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/2024-7-0x0000000001F60000-0x0000000001F68000-memory.dmpFilesize
32KB
-
memory/2024-9-0x0000000005010000-0x000000000507C000-memory.dmpFilesize
432KB
-
memory/2024-2-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB