Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
HY_RAY_RFQ,pdf .exe
Resource
win7v20201028
General
-
Target
HY_RAY_RFQ,pdf .exe
-
Size
812KB
-
MD5
16e55e5dbbf48b3f0d453ac7fcccd908
-
SHA1
7705956e0cf0d5d3e0429c1539dfc204e01c7d87
-
SHA256
f641d9449ad546a0e9ff2f015ff03f9ce0263867caaef3a5cc462fd9b685b928
-
SHA512
111812911c27801addb81373f3dcc7c2f3200c44e2ddcca33fe4989bfc81b5fd6662f2db33e0ae79a36787985ed1e6fc756baf8e4dda847111beb134f4afea5d
Malware Config
Extracted
asyncrat
0.5.7B
null:null
AsyncMutex_6SI8OkPnk
-
aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
billion
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1016-9-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1016-10-0x000000000040C77E-mapping.dmp asyncrat behavioral1/memory/1016-11-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1016-12-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
HY_RAY_RFQ,pdf .exedescription pid process target process PID 1732 set thread context of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
HY_RAY_RFQ,pdf .exepid process 1732 HY_RAY_RFQ,pdf .exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
HY_RAY_RFQ,pdf .exeHY_RAY_RFQ,pdf .exedescription pid process Token: SeDebugPrivilege 1732 HY_RAY_RFQ,pdf .exe Token: SeDebugPrivilege 1016 HY_RAY_RFQ,pdf .exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
HY_RAY_RFQ,pdf .exedescription pid process target process PID 1732 wrote to memory of 1608 1732 HY_RAY_RFQ,pdf .exe schtasks.exe PID 1732 wrote to memory of 1608 1732 HY_RAY_RFQ,pdf .exe schtasks.exe PID 1732 wrote to memory of 1608 1732 HY_RAY_RFQ,pdf .exe schtasks.exe PID 1732 wrote to memory of 1608 1732 HY_RAY_RFQ,pdf .exe schtasks.exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 1732 wrote to memory of 1016 1732 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\etElxxOddDniUS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6789.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6789.tmpMD5
99c0e03148a45e4f86bd88d056ea9aa2
SHA1d2eabb3feaa77b4f5e9d51d84a76bb18996433f0
SHA256894ea3e47cd1046911d2f728d57e5f7ca3f71705f8c11af684e867ddfb264e7d
SHA5129c1fc6b4be5c2992cd63d3784b0f932a9cdb85c5284b968d0e6cee719e2aa3d7d231110c800dde2d1309ee6177c65a361f925c1ccec485271314e2d27db15731
-
memory/1016-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-10-0x000000000040C77E-mapping.dmp
-
memory/1016-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1016-13-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1608-7-0x0000000000000000-mapping.dmp
-
memory/1732-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1732-3-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/1732-5-0x00000000004B0000-0x00000000004C3000-memory.dmpFilesize
76KB
-
memory/1732-6-0x0000000004D40000-0x0000000004D89000-memory.dmpFilesize
292KB