Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
PO1807200020_XLS.scr
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO1807200020_XLS.scr
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
PO1807200020_XLS.scr
-
Size
271KB
-
MD5
981ee0bdf8ccd8ecaba13eefa6c58fb9
-
SHA1
a70e9310bf6bd033710321e1dfe77d3377237c36
-
SHA256
b05af3b65673a21e658075117c050ce9ebdf47634b64e354a6abf241fc8e8a9e
-
SHA512
ec52f6bd62bbf21de8be391cd2a16ffee274ed5462d5bf23c15d7eea0f535f5741389a15fed9e0ac1feb3c317120a02afd8527ce5493591c54edd4340654686d
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6A
Botnet
5
C2
62.102.148.158:62727
82.102.28.107:62727
Mutex
xfndfpqfqzwft
Attributes
-
delay
0
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/940-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/940-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/940-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/940-65-0x000000000040C39E-mapping.dmp asyncrat behavioral1/memory/940-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/940-69-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO1807200020_XLS.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\hl4q5gkwOzkP = "\"C:\\Users\\Admin\\AppData\\Roaming\\hl4q5gkwOzkP.exe\"" PO1807200020_XLS.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO1807200020_XLS.scrdescription pid process target process PID 912 set thread context of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
PO1807200020_XLS.scrPO1807200020_XLS.scrpid process 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 912 PO1807200020_XLS.scr 940 PO1807200020_XLS.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO1807200020_XLS.scrPO1807200020_XLS.scrdescription pid process Token: SeDebugPrivilege 912 PO1807200020_XLS.scr Token: SeDebugPrivilege 940 PO1807200020_XLS.scr -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PO1807200020_XLS.scrdescription pid process target process PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr PID 912 wrote to memory of 940 912 PO1807200020_XLS.scr PO1807200020_XLS.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO1807200020_XLS.scr"C:\Users\Admin\AppData\Local\Temp\PO1807200020_XLS.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO1807200020_XLS.scr"C:\Users\Admin\AppData\Local\Temp\PO1807200020_XLS.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-54-0x0000000000AE0000-0x0000000000B2A000-memory.dmpFilesize
296KB
-
memory/912-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/912-56-0x0000000000480000-0x00000000004B4000-memory.dmpFilesize
208KB
-
memory/912-57-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/912-58-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/940-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-65-0x000000000040C39E-mapping.dmp
-
memory/940-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/940-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB