Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 07:46
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-210067.xls.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER-210067.xls.exe
Resource
win10v20210410
General
-
Target
ORDER-210067.xls.exe
-
Size
1.2MB
-
MD5
0afcb9f210ad0fbae66276f583a0d04b
-
SHA1
d26d65ae6cad14cbdeb1edfdca9d3eba3dee1c5c
-
SHA256
c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73
-
SHA512
9aa577f488eca1846e8e10fae445164a03406189e65a8abd7a78f563af06999a0f1a97015da3cd008327ba125eacb421cf1352de6034e9ee6fbba64473b91b04
Malware Config
Extracted
asyncrat
0.5.7B
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49746
chongmei33.publicvm.com:49703
chongmei33.publicvm.com:46943
185.165.153.116:2703
185.165.153.116:49746
185.165.153.116:49703
185.165.153.116:46943
54.37.36.116:2703
54.37.36.116:49746
54.37.36.116:49703
54.37.36.116:46943
185.244.30.92:2703
185.244.30.92:49746
185.244.30.92:49703
185.244.30.92:46943
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49746
dongreg202020.duckdns.org:49703
dongreg202020.duckdns.org:46943
178.33.222.241:2703
178.33.222.241:49746
178.33.222.241:49703
178.33.222.241:46943
rahim321.duckdns.org:2703
rahim321.duckdns.org:49746
rahim321.duckdns.org:49703
rahim321.duckdns.org:46943
79.134.225.92:2703
79.134.225.92:49746
79.134.225.92:49703
79.134.225.92:46943
37.120.208.36:2703
37.120.208.36:49746
37.120.208.36:49703
37.120.208.36:46943
178.33.222.243:2703
178.33.222.243:49746
178.33.222.243:49703
178.33.222.243:46943
87.98.245.48:2703
87.98.245.48:49746
87.98.245.48:49703
87.98.245.48:46943
AsyncMutex_6SI8OkPnk
-
aes_key
URB8HbE2qoPxdQcCDSu3DcXrIBKuvbaM
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
APP
-
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
2703,49746,49703,46943
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1552-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1552-64-0x000000000040C92E-mapping.dmp asyncrat behavioral1/memory/1552-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ORDER-210067.xls.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\AppData\\Roaming\\word\\svchost.exe.exe" ORDER-210067.xls.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run ORDER-210067.xls.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER-210067.xls.exedescription pid process target process PID 1684 set thread context of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1552 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORDER-210067.xls.exepid process 1684 ORDER-210067.xls.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ORDER-210067.xls.exedescription pid process target process PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe PID 1684 wrote to memory of 1552 1684 ORDER-210067.xls.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER-210067.xls.exe"C:\Users\Admin\AppData\Local\Temp\ORDER-210067.xls.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1552-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1552-64-0x000000000040C92E-mapping.dmp
-
memory/1552-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1552-68-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/1684-62-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB