Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:18
Behavioral task
behavioral1
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win10v2004-20220414-en
General
-
Target
FedexTrackingClearanceInformation_PDF.exe
-
Size
2.1MB
-
MD5
49ed9fd1bfe4e4d685f014084d3b11b4
-
SHA1
ad9aa4dedddcd8de2d2fab04344d8f26c165537d
-
SHA256
f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
-
SHA512
b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
Malware Config
Extracted
asyncrat
0.5.7B
GRACE OVERFLOW
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Q3bqVVf9
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1928-54-0x0000000000E60000-0x0000000001082000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\lfrbuild.exe asyncrat C:\Users\Admin\AppData\Roaming\lfrbuild.exe asyncrat C:\Users\Admin\AppData\Roaming\lfrbuild.exe asyncrat behavioral1/memory/2024-63-0x0000000000FB0000-0x00000000011D2000-memory.dmp asyncrat behavioral1/memory/824-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/824-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/824-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/824-74-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/824-77-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/824-79-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
lfrbuild.exeAddInProcess32.exepid process 2024 lfrbuild.exe 824 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exepid process 1928 FedexTrackingClearanceInformation_PDF.exe 2024 lfrbuild.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\rflbuild = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\lfrbuild.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfrbuild.exedescription pid process target process PID 2024 set thread context of 824 2024 lfrbuild.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exepid process 1928 FedexTrackingClearanceInformation_PDF.exe 1928 FedexTrackingClearanceInformation_PDF.exe 2024 lfrbuild.exe 2024 lfrbuild.exe 2024 lfrbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1928 FedexTrackingClearanceInformation_PDF.exe Token: SeDebugPrivilege 2024 lfrbuild.exe Token: SeDebugPrivilege 824 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.execmd.exelfrbuild.exedescription pid process target process PID 1928 wrote to memory of 1728 1928 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1928 wrote to memory of 1728 1928 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1928 wrote to memory of 1728 1928 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1928 wrote to memory of 1728 1928 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 1728 wrote to memory of 1544 1728 cmd.exe reg.exe PID 1728 wrote to memory of 1544 1728 cmd.exe reg.exe PID 1728 wrote to memory of 1544 1728 cmd.exe reg.exe PID 1728 wrote to memory of 1544 1728 cmd.exe reg.exe PID 1928 wrote to memory of 2024 1928 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1928 wrote to memory of 2024 1928 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1928 wrote to memory of 2024 1928 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 1928 wrote to memory of 2024 1928 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe PID 2024 wrote to memory of 824 2024 lfrbuild.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exe"C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exeFilesize
2.1MB
MD549ed9fd1bfe4e4d685f014084d3b11b4
SHA1ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exeFilesize
2.1MB
MD549ed9fd1bfe4e4d685f014084d3b11b4
SHA1ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Roaming\lfrbuild.exeFilesize
2.1MB
MD549ed9fd1bfe4e4d685f014084d3b11b4
SHA1ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
-
memory/824-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-74-0x000000000040C75E-mapping.dmp
-
memory/824-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/824-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1544-58-0x0000000000000000-mapping.dmp
-
memory/1728-57-0x0000000000000000-mapping.dmp
-
memory/1928-56-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1928-54-0x0000000000E60000-0x0000000001082000-memory.dmpFilesize
2.1MB
-
memory/1928-55-0x0000000000210000-0x000000000021A000-memory.dmpFilesize
40KB
-
memory/2024-60-0x0000000000000000-mapping.dmp
-
memory/2024-65-0x0000000000350000-0x0000000000358000-memory.dmpFilesize
32KB
-
memory/2024-63-0x0000000000FB0000-0x00000000011D2000-memory.dmpFilesize
2.1MB