Analysis
- max time kernel
132s - max time network
135s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/06/2021, 07:07
General
- Target No.Purchase Order 02902-28361.exe
- Size 321KB
- Sample210624-mc3agls2nx
- SHA256 cc43f37f9eb41430bbfb6f1515b65c5fd2bc7b7565701c71aa65731fdf46c288
Malware Config
Extracted
-
asyncrat
-
0.5.6A
-
lambertofield1.ddns.net:1515
-
79.134.225.124:1515
-
ubbgqgwizl
-
aes_key
MAa0OfWTKZeWOryYtjTHg2b3gFYQBA8d
-
anti_detection
false
-
autorun
false
-
bdos
false
- delay
-
host
lambertofield1.ddns.net,79.134.225.124
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
ubbgqgwizl
-
pastebin_config
null
-
port
1515
-
version
0.5.6A
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 3 IoCs
- Drops startup file 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\No.Purchase Order 02902-28361.exe"2⤵
- Drops startup file
-
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1268-59-0x0000000000150000-0x0000000000151000-memory.dmp
memory/1268-61-0x0000000000510000-0x0000000000551000-memory.dmp
memory/1268-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/1268-65-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/1516-66-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1516-68-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1516-70-0x0000000004300000-0x0000000004301000-memory.dmp