Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 13:08
Static task
static1
Behavioral task
behavioral1
Sample
Order confirmation 06022784.pdf.exe
Resource
win7v20201028
General
-
Target
Order confirmation 06022784.pdf.exe
-
Size
817KB
-
MD5
ebf8d48b57fd020ab580207bc3b0a77d
-
SHA1
ba9edcfaef488765bf017697887f35e351fa0224
-
SHA256
3dd4c0a246882a35140b2476292a4070038e90755d0f9d9da65daa06a99880f8
-
SHA512
a9705cb87c475eb76a8e5fd27708acfbb438e57939cfee9ae5631035b3d7a04b5cec2f302348045f1535ee8e37fb4cd0f524d1e36cc93252f6254db8d0740cd9
Malware Config
Extracted
asyncrat
0.5.7B
79.134.225.23:30493
AsyncMutex_6SI8OkPnk
-
aes_key
fAuR6N9PDMVk4kTOwMECuVUvSQaoRRKq
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
79.134.225.23
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
30493
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/512-10-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/512-11-0x000000000040C70E-mapping.dmp asyncrat behavioral1/memory/512-13-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order confirmation 06022784.pdf.exedescription pid process target process PID 1064 set thread context of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order confirmation 06022784.pdf.exedescription pid process target process PID 1064 wrote to memory of 1808 1064 Order confirmation 06022784.pdf.exe schtasks.exe PID 1064 wrote to memory of 1808 1064 Order confirmation 06022784.pdf.exe schtasks.exe PID 1064 wrote to memory of 1808 1064 Order confirmation 06022784.pdf.exe schtasks.exe PID 1064 wrote to memory of 1808 1064 Order confirmation 06022784.pdf.exe schtasks.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe PID 1064 wrote to memory of 512 1064 Order confirmation 06022784.pdf.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order confirmation 06022784.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order confirmation 06022784.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\efpeKLFkInvP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE10C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE10C.tmpMD5
d0e12d344a3fe484ca64be915fa551d5
SHA1b7f2a25b545154576afcea6e7966f68e0105d2e6
SHA2569abecdef4df035e0e24adeae9e8d5312c194247fafc471209711a6d496b1ea42
SHA512504b78d4b88eab4ee5ca9c74730d91ae765109345f798127734fcd0655548d7ad80f3efb46e2a1c99d25448d41f7f7bdcc384cee84d88d3214ce21877aad8a4f
-
memory/512-12-0x0000000073C60000-0x000000007434E000-memory.dmpFilesize
6.9MB
-
memory/512-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/512-11-0x000000000040C70E-mapping.dmp
-
memory/512-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/512-15-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/512-16-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/1064-5-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/1064-6-0x00000000002E0000-0x00000000002EE000-memory.dmpFilesize
56KB
-
memory/1064-7-0x0000000001EC0000-0x0000000001EEA000-memory.dmpFilesize
168KB
-
memory/1064-3-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1064-2-0x0000000073C60000-0x000000007434E000-memory.dmpFilesize
6.9MB
-
memory/1808-8-0x0000000000000000-mapping.dmp