Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
HY_RAY_RFQ,pdf .exe
Resource
win7v20201028
General
-
Target
HY_RAY_RFQ,pdf .exe
-
Size
812KB
-
MD5
16e55e5dbbf48b3f0d453ac7fcccd908
-
SHA1
7705956e0cf0d5d3e0429c1539dfc204e01c7d87
-
SHA256
f641d9449ad546a0e9ff2f015ff03f9ce0263867caaef3a5cc462fd9b685b928
-
SHA512
111812911c27801addb81373f3dcc7c2f3200c44e2ddcca33fe4989bfc81b5fd6662f2db33e0ae79a36787985ed1e6fc756baf8e4dda847111beb134f4afea5d
Malware Config
Extracted
asyncrat
0.5.7B
null:null
AsyncMutex_6SI8OkPnk
-
aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
billion
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
-
port
null
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/992-14-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/992-15-0x000000000040C77E-mapping.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
HY_RAY_RFQ,pdf .exedescription pid process target process PID 4684 set thread context of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
HY_RAY_RFQ,pdf .exepid process 4684 HY_RAY_RFQ,pdf .exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
HY_RAY_RFQ,pdf .exeHY_RAY_RFQ,pdf .exedescription pid process Token: SeDebugPrivilege 4684 HY_RAY_RFQ,pdf .exe Token: SeDebugPrivilege 992 HY_RAY_RFQ,pdf .exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
HY_RAY_RFQ,pdf .exedescription pid process target process PID 4684 wrote to memory of 636 4684 HY_RAY_RFQ,pdf .exe schtasks.exe PID 4684 wrote to memory of 636 4684 HY_RAY_RFQ,pdf .exe schtasks.exe PID 4684 wrote to memory of 636 4684 HY_RAY_RFQ,pdf .exe schtasks.exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe PID 4684 wrote to memory of 992 4684 HY_RAY_RFQ,pdf .exe HY_RAY_RFQ,pdf .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\etElxxOddDniUS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"C:\Users\Admin\AppData\Local\Temp\HY_RAY_RFQ,pdf .exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HY_RAY_RFQ,pdf .exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tmp29C.tmpMD5
6d3c292a85c2538aa81ee253d077291b
SHA1ea19fde96d6da4b54f45f0bd877817a99105b619
SHA256f671a0b49de2a673ed97bdeb04c54afaf6cf3861f19c265abbb87ff50379e333
SHA5128372d299a0e6e9352fa3f37d3376267095b0e5e71fc165634126ce8194f4eb963b7fd82c8b7fb29e3d0feaf7a4abb6c6643a6f7fe7d0b6b037672814ed5b1a74
-
memory/636-12-0x0000000000000000-mapping.dmp
-
memory/992-17-0x0000000073430000-0x0000000073B1E000-memory.dmpFilesize
6.9MB
-
memory/992-15-0x000000000040C77E-mapping.dmp
-
memory/992-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4684-6-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/4684-10-0x00000000056D0000-0x00000000056E3000-memory.dmpFilesize
76KB
-
memory/4684-11-0x0000000001080000-0x00000000010C9000-memory.dmpFilesize
292KB
-
memory/4684-9-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/4684-8-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/4684-7-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/4684-2-0x0000000073430000-0x0000000073B1E000-memory.dmpFilesize
6.9MB
-
memory/4684-5-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/4684-3-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB