Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 13:08
Static task
static1
Behavioral task
behavioral1
Sample
Order confirmation 06022784.pdf.exe
Resource
win7v20201028
General
-
Target
Order confirmation 06022784.pdf.exe
-
Size
817KB
-
MD5
ebf8d48b57fd020ab580207bc3b0a77d
-
SHA1
ba9edcfaef488765bf017697887f35e351fa0224
-
SHA256
3dd4c0a246882a35140b2476292a4070038e90755d0f9d9da65daa06a99880f8
-
SHA512
a9705cb87c475eb76a8e5fd27708acfbb438e57939cfee9ae5631035b3d7a04b5cec2f302348045f1535ee8e37fb4cd0f524d1e36cc93252f6254db8d0740cd9
Malware Config
Extracted
asyncrat
0.5.7B
79.134.225.23:30493
AsyncMutex_6SI8OkPnk
-
aes_key
fAuR6N9PDMVk4kTOwMECuVUvSQaoRRKq
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
79.134.225.23
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
30493
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1176-14-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1176-15-0x000000000040C70E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order confirmation 06022784.pdf.exedescription pid process target process PID 3884 set thread context of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order confirmation 06022784.pdf.exepid process 3884 Order confirmation 06022784.pdf.exe 3884 Order confirmation 06022784.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Order confirmation 06022784.pdf.exedescription pid process Token: SeDebugPrivilege 3884 Order confirmation 06022784.pdf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Order confirmation 06022784.pdf.exedescription pid process target process PID 3884 wrote to memory of 2484 3884 Order confirmation 06022784.pdf.exe schtasks.exe PID 3884 wrote to memory of 2484 3884 Order confirmation 06022784.pdf.exe schtasks.exe PID 3884 wrote to memory of 2484 3884 Order confirmation 06022784.pdf.exe schtasks.exe PID 3884 wrote to memory of 1976 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1976 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1976 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe PID 3884 wrote to memory of 1176 3884 Order confirmation 06022784.pdf.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order confirmation 06022784.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order confirmation 06022784.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\efpeKLFkInvP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB56B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB56B.tmpMD5
21c5fc9b67a85ae8fe0a522749ebcbfc
SHA10bb40f4dc937405364129ef05739e1b0810284b4
SHA256a520f046be27120e276e475fecdb39de47e5c0c6b100091b09af446bcdd6fe83
SHA5129b247b8927aaf5438a1cbfe57cbac9082add42e304026ccdaf502846ed625715a447d710994853c39017d98b4c527a5a46f5785ebc667190104ce3091eb0f5f4
-
memory/1176-19-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/1176-16-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/1176-15-0x000000000040C70E-mapping.dmp
-
memory/1176-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2484-12-0x0000000000000000-mapping.dmp
-
memory/3884-6-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/3884-10-0x0000000007310000-0x000000000733A000-memory.dmpFilesize
168KB
-
memory/3884-11-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/3884-9-0x0000000005800000-0x000000000580E000-memory.dmpFilesize
56KB
-
memory/3884-8-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3884-7-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3884-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3884-5-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/3884-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB