Analysis
-
max time kernel
120s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-01-2021 15:52
Behavioral task
behavioral1
Sample
WindowsForsApp2.jpg.exe
Resource
win7v20201028
General
-
Target
WindowsForsApp2.jpg.exe
-
Size
45KB
-
MD5
d3a6b158e1e9696487764681659b132e
-
SHA1
5e55263eda3d62389ca0f8e08a75a65e1afd7e40
-
SHA256
ce0530832a781bd0ca193f10973c554c051cbebd189339c2ff31b60638914a89
-
SHA512
ecb4e7320979490e219a71812c640af8c2f9ac9303b7c16993961c4f89c23c49f3620cd0940f36cc69371df0386582f6ac7204d07d14cae6e0271956416c234f
Malware Config
Extracted
asyncrat
0.5.7B
103.147.184.53:1991
AsyncMutex_6SI8OkPnk
-
aes_key
jAIQjLUDDlRsSW2EWQFUO3GpJGouneMb
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
103.147.184.53
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
1991
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\tax refund.exe asyncrat C:\Users\Admin\AppData\Roaming\tax refund.exe asyncrat C:\Users\Admin\AppData\Roaming\tax refund.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
tax refund.exepid process 268 tax refund.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1224 cmd.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1692 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
WindowsForsApp2.jpg.exepid process 932 WindowsForsApp2.jpg.exe 932 WindowsForsApp2.jpg.exe 932 WindowsForsApp2.jpg.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
WindowsForsApp2.jpg.exetax refund.exedescription pid process Token: SeDebugPrivilege 932 WindowsForsApp2.jpg.exe Token: SeDebugPrivilege 268 tax refund.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
WindowsForsApp2.jpg.execmd.execmd.exedescription pid process target process PID 932 wrote to memory of 1376 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1376 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1376 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1376 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1224 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1224 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1224 932 WindowsForsApp2.jpg.exe cmd.exe PID 932 wrote to memory of 1224 932 WindowsForsApp2.jpg.exe cmd.exe PID 1376 wrote to memory of 1684 1376 cmd.exe schtasks.exe PID 1376 wrote to memory of 1684 1376 cmd.exe schtasks.exe PID 1376 wrote to memory of 1684 1376 cmd.exe schtasks.exe PID 1376 wrote to memory of 1684 1376 cmd.exe schtasks.exe PID 1224 wrote to memory of 1692 1224 cmd.exe timeout.exe PID 1224 wrote to memory of 1692 1224 cmd.exe timeout.exe PID 1224 wrote to memory of 1692 1224 cmd.exe timeout.exe PID 1224 wrote to memory of 1692 1224 cmd.exe timeout.exe PID 1224 wrote to memory of 268 1224 cmd.exe tax refund.exe PID 1224 wrote to memory of 268 1224 cmd.exe tax refund.exe PID 1224 wrote to memory of 268 1224 cmd.exe tax refund.exe PID 1224 wrote to memory of 268 1224 cmd.exe tax refund.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsForsApp2.jpg.exe"C:\Users\Admin\AppData\Local\Temp\WindowsForsApp2.jpg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "tax refund" /tr '"C:\Users\Admin\AppData\Roaming\tax refund.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "tax refund" /tr '"C:\Users\Admin\AppData\Roaming\tax refund.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp31DA.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\tax refund.exe"C:\Users\Admin\AppData\Roaming\tax refund.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp31DA.tmp.batMD5
2dea24668376844b1cb296340e3eace0
SHA196073cbf1fad2cff1fbf6560c6aa671295ed80b1
SHA25631cc2c24dc0e50b803019a625e046ab31fc00a53fbd8f74fb65e032276ca3711
SHA512c728626bbc65b9c7f2507018018a1d5d17cb503bf4edbd946b41c15741e057ddad4d51e53629ae9ea2d9607b992c295300fe06a2a93e05e689f91f144ba7659e
-
C:\Users\Admin\AppData\Roaming\tax refund.exeMD5
d3a6b158e1e9696487764681659b132e
SHA15e55263eda3d62389ca0f8e08a75a65e1afd7e40
SHA256ce0530832a781bd0ca193f10973c554c051cbebd189339c2ff31b60638914a89
SHA512ecb4e7320979490e219a71812c640af8c2f9ac9303b7c16993961c4f89c23c49f3620cd0940f36cc69371df0386582f6ac7204d07d14cae6e0271956416c234f
-
C:\Users\Admin\AppData\Roaming\tax refund.exeMD5
d3a6b158e1e9696487764681659b132e
SHA15e55263eda3d62389ca0f8e08a75a65e1afd7e40
SHA256ce0530832a781bd0ca193f10973c554c051cbebd189339c2ff31b60638914a89
SHA512ecb4e7320979490e219a71812c640af8c2f9ac9303b7c16993961c4f89c23c49f3620cd0940f36cc69371df0386582f6ac7204d07d14cae6e0271956416c234f
-
\Users\Admin\AppData\Roaming\tax refund.exeMD5
d3a6b158e1e9696487764681659b132e
SHA15e55263eda3d62389ca0f8e08a75a65e1afd7e40
SHA256ce0530832a781bd0ca193f10973c554c051cbebd189339c2ff31b60638914a89
SHA512ecb4e7320979490e219a71812c640af8c2f9ac9303b7c16993961c4f89c23c49f3620cd0940f36cc69371df0386582f6ac7204d07d14cae6e0271956416c234f
-
memory/268-12-0x0000000000000000-mapping.dmp
-
memory/268-15-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/268-14-0x00000000734A0000-0x0000000073B8E000-memory.dmpFilesize
6.9MB
-
memory/932-3-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1224-6-0x0000000000000000-mapping.dmp
-
memory/1376-5-0x0000000000000000-mapping.dmp
-
memory/1684-8-0x0000000000000000-mapping.dmp
-
memory/1692-9-0x0000000000000000-mapping.dmp