Analysis
-
max time kernel
128s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 16:30
Static task
static1
Behavioral task
behavioral1
Sample
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
Resource
win7v20201028
General
-
Target
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
-
Size
1.0MB
-
MD5
2596a24f0668203076e4829fa72dcfe7
-
SHA1
6d47cd0fa430e89e98931c487a179de58b943521
-
SHA256
009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
-
SHA512
267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
Malware Config
Extracted
asyncrat
0.5.7B
productos.linkpc.net:3470
AsyncMutex_6SI8OkPnk
-
aes_key
cRDJUz3TELGT8tZPsxRbzbKFZunEqWvB
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
productos.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
3470
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2756-15-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2756-16-0x000000000040C76E-mapping.dmp asyncrat behavioral2/memory/4036-44-0x000000000040C76E-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
dllwindefenderp.exedllwindefenderp.exepid process 3420 dllwindefenderp.exe 4036 dllwindefenderp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedescription pid process target process PID 640 set thread context of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 3420 set thread context of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3948 timeout.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepid process 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedescription pid process Token: SeDebugPrivilege 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe Token: SeDebugPrivilege 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe Token: SeDebugPrivilege 4036 dllwindefenderp.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.execmd.execmd.exedllwindefenderp.exedescription pid process target process PID 640 wrote to memory of 1588 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 1588 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 1588 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2608 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2608 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2608 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 640 wrote to memory of 2756 640 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2756 wrote to memory of 2052 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2756 wrote to memory of 2052 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2756 wrote to memory of 2052 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2756 wrote to memory of 2240 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2756 wrote to memory of 2240 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2756 wrote to memory of 2240 2756 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2052 wrote to memory of 4012 2052 cmd.exe schtasks.exe PID 2052 wrote to memory of 4012 2052 cmd.exe schtasks.exe PID 2052 wrote to memory of 4012 2052 cmd.exe schtasks.exe PID 2240 wrote to memory of 3948 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 3948 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 3948 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 3420 2240 cmd.exe dllwindefenderp.exe PID 2240 wrote to memory of 3420 2240 cmd.exe dllwindefenderp.exe PID 2240 wrote to memory of 3420 2240 cmd.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe PID 3420 wrote to memory of 4036 3420 dllwindefenderp.exe dllwindefenderp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"2⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"2⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"'4⤵
- Creates scheduled task(s)
PID:4012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp47E7.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:3948 -
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllwindefenderp.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tmp47E7.tmp.batMD5
eb3738bd49dca0cc223322b563277b21
SHA1ea7991e3416da3755af48c34aa7f70d32d885d4c
SHA25604bd5158340308f8fa71b50341e6769dc4b4ecb7bc47fa01ed36a46c154addcc
SHA5129fa333db3977a3606f9ef2bfec3d893057b71a5de2e255a63b3145ee199c288e6e3785b6434cbf7bf308822147766c5b79f5c6b116c75808739448c89cdeac35
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
memory/640-10-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/640-6-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/640-11-0x00000000060F0000-0x000000000617A000-memory.dmpFilesize
552KB
-
memory/640-12-0x0000000005890000-0x0000000005898000-memory.dmpFilesize
32KB
-
memory/640-14-0x0000000005FA0000-0x000000000600C000-memory.dmpFilesize
432KB
-
memory/640-3-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/640-5-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/640-9-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/640-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/640-7-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/640-8-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/2052-22-0x0000000000000000-mapping.dmp
-
memory/2240-23-0x0000000000000000-mapping.dmp
-
memory/2756-18-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2756-16-0x000000000040C76E-mapping.dmp
-
memory/2756-15-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3420-27-0x0000000000000000-mapping.dmp
-
memory/3420-30-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/3948-26-0x0000000000000000-mapping.dmp
-
memory/4012-25-0x0000000000000000-mapping.dmp
-
memory/4036-44-0x000000000040C76E-mapping.dmp
-
memory/4036-47-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB