Overview

overview

10

Static

static

Request For Quote.exe

windows7_x64

10

Request For Quote.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-06-2021 03:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Request For Quote.exe

  • Size

    723KB

  • MD5

    60b38fcb88892b72f97c72a04b03ce29

  • SHA1

    90a9b8272b1c39aba84ceb9c53aa1b041fb61f6b

  • SHA256

    86a970ceae4a26b7b3cca4894885278b76aede70d85c92a2c55d9fe4d950a879

  • SHA512

    a5fe465d7fd3dc278c85be115ae060b85a069f445d3a768064e34fa51de08221368890bce5f958bc2133fbc4bfbc8393b7a0fff7a9093f80ef82dd6d8fad4477

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

kingmethod.duckdns.org:6606

kingmethod.duckdns.org:7707

kingmethod.duckdns.org:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    OZXGLSBOBV86soeiTb9Hf1tQxfBtCgFw

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    ,kingmethod.duckdns.org

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6606,7707,8808

  • version

    0.5.7B

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 3 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe
    "C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wTWgfPg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp49DC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1600
    • C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe
      "C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"
      2⤵
        PID:1512
      • C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe
        "C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:952

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp49DC.tmp
      MD5

      be13e92bb5542796b8b6b2852f95d396

      SHA1

      6616dd53157b74939e7fa1d81a7d171ae657f7d1

      SHA256

      4d1773394ae7bade10f65890da9b7073ab4e69121359d489600c035e1a81c85b

      SHA512

      ea92b0e3bd0b55ea55a1e08cd03bae6ae53b94cf5ae7a0f72ad398ce96fc6b4ad4e26d2428c8ce7fc38dd028d330abcea97e6a5d668aa9a69740d5efb9b9d480

      Download Submit
    • memory/952-68-0x000000000040C73E-mapping.dmp
      Download
    • memory/952-67-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/952-69-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/952-71-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1600-65-0x0000000000000000-mapping.dmp
      Download
    • memory/1848-59-0x0000000000260000-0x0000000000261000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1848-61-0x0000000002210000-0x0000000002211000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1848-62-0x0000000000670000-0x000000000068E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/1848-63-0x0000000004D20000-0x0000000004D8F000-memory.dmp
      Filesize

      444KB

      Download
    • memory/1848-64-0x00000000042C0000-0x00000000042E8000-memory.dmp
      Filesize

      160KB

      Download