Analysis
-
max time kernel
300s -
max time network
310s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-09-2021 00:39
Static task
static1
Behavioral task
behavioral1
Sample
New_Order_PO#96072380_MT_Quote.exe
Resource
win7-en
General
-
Target
New_Order_PO#96072380_MT_Quote.exe
-
Size
13KB
-
MD5
1ef313f5642433857bfb3eb1903faf84
-
SHA1
b3c5a85551caff85b646c8175ceb297a6eb61d32
-
SHA256
4def53afd3cfa7cf644b61a877f18ceed798dc8f62268afb52827ee61280d3ac
-
SHA512
97ca39b7fd37920f737d69c7e99bff78e40f74b0e7fc6c15355da79b070577ef3d9fddfcd571bdcee35ef442bb6f50e81b27f4069cb7e13e87b36d43339fc27f
Malware Config
Extracted
asyncrat
0.5.6A
joseedward5001.ddns.net:1515
194.5.98.120:1515
cfbtvyfbge
-
anti_vm
false
-
bsod
false
-
delay
5
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5056-133-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/5056-134-0x000000000040C3BE-mapping.dmp asyncrat -
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exedescription pid process target process PID 4652 set thread context of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exeNew_Order_PO#96072380_MT_Quote.exepid process 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 4652 New_Order_PO#96072380_MT_Quote.exe 5056 New_Order_PO#96072380_MT_Quote.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exeNew_Order_PO#96072380_MT_Quote.exedescription pid process Token: SeDebugPrivilege 4652 New_Order_PO#96072380_MT_Quote.exe Token: SeDebugPrivilege 5056 New_Order_PO#96072380_MT_Quote.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
New_Order_PO#96072380_MT_Quote.exedescription pid process target process PID 4652 wrote to memory of 4768 4652 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 4652 wrote to memory of 4768 4652 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 4652 wrote to memory of 4768 4652 New_Order_PO#96072380_MT_Quote.exe cmd.exe PID 4652 wrote to memory of 5048 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5048 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5048 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe PID 4652 wrote to memory of 5056 4652 New_Order_PO#96072380_MT_Quote.exe New_Order_PO#96072380_MT_Quote.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"C:\Users\Admin\AppData\Local\Temp\New_Order_PO#96072380_MT_Quote.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New_Order_PO#96072380_MT_Quote.exeMD5
1ef313f5642433857bfb3eb1903faf84
SHA1b3c5a85551caff85b646c8175ceb297a6eb61d32
SHA2564def53afd3cfa7cf644b61a877f18ceed798dc8f62268afb52827ee61280d3ac
SHA51297ca39b7fd37920f737d69c7e99bff78e40f74b0e7fc6c15355da79b070577ef3d9fddfcd571bdcee35ef442bb6f50e81b27f4069cb7e13e87b36d43339fc27f
-
memory/4652-118-0x00000000052B0000-0x00000000057AE000-memory.dmpFilesize
5.0MB
-
memory/4652-117-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/4652-114-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/4652-119-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/4652-120-0x0000000009400000-0x0000000009425000-memory.dmpFilesize
148KB
-
memory/4652-121-0x00000000095F0000-0x00000000095F1000-memory.dmpFilesize
4KB
-
memory/4652-123-0x0000000009700000-0x0000000009701000-memory.dmpFilesize
4KB
-
memory/4652-116-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/4652-125-0x0000000009580000-0x0000000009581000-memory.dmpFilesize
4KB
-
memory/4768-122-0x0000000000000000-mapping.dmp
-
memory/5056-133-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5056-134-0x000000000040C3BE-mapping.dmp
-
memory/5056-137-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB