Analysis
-
max time kernel
296s -
max time network
299s -
platform
windows7_x64 -
resource
win7-en -
submitted
14-09-2021 00:39
Static task
static1
Behavioral task
behavioral1
Sample
New_Order_PO#96072380_MT_Quote.exe
Resource
win7-en
General
-
Target
New_Order_PO#96072380_MT_Quote.exe
-
Size
13KB
-
MD5
1ef313f5642433857bfb3eb1903faf84
-
SHA1
b3c5a85551caff85b646c8175ceb297a6eb61d32
-
SHA256
4def53afd3cfa7cf644b61a877f18ceed798dc8f62268afb52827ee61280d3ac
-
SHA512
97ca39b7fd37920f737d69c7e99bff78e40f74b0e7fc6c15355da79b070577ef3d9fddfcd571bdcee35ef442bb6f50e81b27f4069cb7e13e87b36d43339fc27f
Malware Config
Extracted
asyncrat
0.5.6A
joseedward5001.ddns.net:1515
194.5.98.120:1515
cfbtvyfbge
-
anti_vm
false
-
bsod
false
-
delay
5
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1420-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1420-68-0x000000000040C3BE-mapping.dmp asyncrat behavioral1/memory/1420-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exedescription pid process target process PID 1032 set thread context of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exeNew_Order_PO#96072380_MT_Quote.exepid process 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1032 New_Order_PO#96072380_MT_Quote.exe 1420 New_Order_PO#96072380_MT_Quote.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exeNew_Order_PO#96072380_MT_Quote.exedescription pid process Token: SeDebugPrivilege 1032 New_Order_PO#96072380_MT_Quote.exe Token: SeDebugPrivilege 1420 New_Order_PO#96072380_MT_Quote.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exedescription pid process target process PID 1032 wrote to memory of 240 1032 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 1032 wrote to memory of 240 1032 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 1032 wrote to memory of 240 1032 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 1032 wrote to memory of 240 1032 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 1032 wrote to memory of 1420 1032 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exeMD5
1ef313f5642433857bfb3eb1903faf84
SHA1b3c5a85551caff85b646c8175ceb297a6eb61d32
SHA2564def53afd3cfa7cf644b61a877f18ceed798dc8f62268afb52827ee61280d3ac
SHA51297ca39b7fd37920f737d69c7e99bff78e40f74b0e7fc6c15355da79b070577ef3d9fddfcd571bdcee35ef442bb6f50e81b27f4069cb7e13e87b36d43339fc27f
-
memory/240-57-0x0000000000000000-mapping.dmp
-
memory/1032-53-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/1032-55-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/1032-56-0x0000000001F00000-0x0000000001F25000-memory.dmpFilesize
148KB
-
memory/1032-59-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/1420-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1420-68-0x000000000040C3BE-mapping.dmp
-
memory/1420-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1420-71-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1420-72-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB