Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:18
Behavioral task
behavioral1
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
FedexTrackingClearanceInformation_PDF.exe
Resource
win10v2004-20220414-en
General
-
Target
FedexTrackingClearanceInformation_PDF.exe
-
Size
2.1MB
-
MD5
49ed9fd1bfe4e4d685f014084d3b11b4
-
SHA1
ad9aa4dedddcd8de2d2fab04344d8f26c165537d
-
SHA256
f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
-
SHA512
b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
Malware Config
Extracted
asyncrat
0.5.7B
GRACE OVERFLOW
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Q3bqVVf9
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2996-130-0x0000000000EB0000-0x00000000010D2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\lfrbuild.exe asyncrat C:\Users\Admin\AppData\Roaming\lfrbuild.exe asyncrat behavioral2/memory/1860-139-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
lfrbuild.exeAddInProcess32.exepid process 340 lfrbuild.exe 1860 AddInProcess32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FedexTrackingClearanceInformation_PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation FedexTrackingClearanceInformation_PDF.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rflbuild = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\lfrbuild.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfrbuild.exedescription pid process target process PID 340 set thread context of 1860 340 lfrbuild.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exepid process 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 2996 FedexTrackingClearanceInformation_PDF.exe 340 lfrbuild.exe 340 lfrbuild.exe 340 lfrbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.exelfrbuild.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2996 FedexTrackingClearanceInformation_PDF.exe Token: SeDebugPrivilege 340 lfrbuild.exe Token: SeDebugPrivilege 1860 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
FedexTrackingClearanceInformation_PDF.execmd.exelfrbuild.exedescription pid process target process PID 2996 wrote to memory of 5008 2996 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 2996 wrote to memory of 5008 2996 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 2996 wrote to memory of 5008 2996 FedexTrackingClearanceInformation_PDF.exe cmd.exe PID 5008 wrote to memory of 1452 5008 cmd.exe reg.exe PID 5008 wrote to memory of 1452 5008 cmd.exe reg.exe PID 5008 wrote to memory of 1452 5008 cmd.exe reg.exe PID 2996 wrote to memory of 340 2996 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 2996 wrote to memory of 340 2996 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 2996 wrote to memory of 340 2996 FedexTrackingClearanceInformation_PDF.exe lfrbuild.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe PID 340 wrote to memory of 1860 340 lfrbuild.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v rflbuild /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\lfrbuild.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exe"C:\Users\Admin\AppData\Roaming\lfrbuild.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exeFilesize
2.1MB
MD549ed9fd1bfe4e4d685f014084d3b11b4
SHA1ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
-
C:\Users\Admin\AppData\Roaming\lfrbuild.exeFilesize
2.1MB
MD549ed9fd1bfe4e4d685f014084d3b11b4
SHA1ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466
-
memory/340-135-0x0000000000000000-mapping.dmp
-
memory/1452-134-0x0000000000000000-mapping.dmp
-
memory/1860-138-0x0000000000000000-mapping.dmp
-
memory/1860-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2996-130-0x0000000000EB0000-0x00000000010D2000-memory.dmpFilesize
2.1MB
-
memory/2996-131-0x0000000006080000-0x0000000006624000-memory.dmpFilesize
5.6MB
-
memory/2996-132-0x0000000005BA0000-0x0000000005C32000-memory.dmpFilesize
584KB
-
memory/5008-133-0x0000000000000000-mapping.dmp