Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 04:56
Static task
static1
Behavioral task
behavioral1
Sample
purchase order 0234.exe
Resource
win7v20210408
General
-
Target
purchase order 0234.exe
-
Size
810KB
-
MD5
b7293e08d74bd46679ba9d8676c905ad
-
SHA1
b64e7adaa11fa0d7ef383812978ffb0346d4ccf9
-
SHA256
643bb75abd587887ae08a595d8c194324896a35e67e7e1f9d0cbca072d80a35f
-
SHA512
125e62710e469b5349bc4d7b5415273fabc3c73883b41cd797512c5e7867f7af2ab4f228b2017e6921a86fde6479b41580729ba36b42172ce150edf783a0f9a4
Malware Config
Extracted
asyncrat
0.5.7B
185.140.53.143:7707
AsyncMutex_6SI8OkPnk
-
aes_key
UVVbfz0hjdu2nFdIsYB5P1g2SduP4tkw
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
185.140.53.143
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
7707
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1308-126-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1308-127-0x000000000040C71E-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
purchase order 0234.exedescription pid process target process PID 2256 set thread context of 1308 2256 purchase order 0234.exe purchase order 0234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
purchase order 0234.exepid process 2256 purchase order 0234.exe 2256 purchase order 0234.exe 2256 purchase order 0234.exe 2256 purchase order 0234.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
purchase order 0234.exedescription pid process Token: SeDebugPrivilege 2256 purchase order 0234.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
purchase order 0234.exedescription pid process target process PID 2256 wrote to memory of 3332 2256 purchase order 0234.exe schtasks.exe PID 2256 wrote to memory of 3332 2256 purchase order 0234.exe schtasks.exe PID 2256 wrote to memory of 3332 2256 purchase order 0234.exe schtasks.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe PID 2256 wrote to memory of 1308 2256 purchase order 0234.exe purchase order 0234.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order 0234.exe"C:\Users\Admin\AppData\Local\Temp\purchase order 0234.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kgXAYFo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7B8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\purchase order 0234.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD7B8.tmpMD5
86a2a33391f86ff7c23f68429094d55d
SHA11eeb68c9191881b66f657378ae2f539280845a02
SHA2560187cbd25716c2efc30d7e9f4412f2c515caeebae1edd6b5dbfe4051ab89e2c0
SHA512a5ff7e7e63b0603ea0d4311ffffd9a70647c157bbfd84a12beff3fc297b827bdc39401246621d17a1db80a8817f20134498b5cef1ff62f62bc4bded132c17251
-
memory/1308-130-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/1308-127-0x000000000040C71E-mapping.dmp
-
memory/1308-126-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2256-121-0x0000000004F20000-0x0000000004F2E000-memory.dmpFilesize
56KB
-
memory/2256-120-0x0000000009790000-0x0000000009791000-memory.dmpFilesize
4KB
-
memory/2256-114-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2256-122-0x0000000005880000-0x00000000058F9000-memory.dmpFilesize
484KB
-
memory/2256-123-0x0000000005F00000-0x0000000005F28000-memory.dmpFilesize
160KB
-
memory/2256-119-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/2256-118-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/2256-117-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/2256-116-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/3332-124-0x0000000000000000-mapping.dmp