Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:21
Static task
static1
Behavioral task
behavioral1
Sample
MAJDALANI INOX SA Pedido.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MAJDALANI INOX SA Pedido.exe
Resource
win10v2004-20220414-en
General
-
Target
MAJDALANI INOX SA Pedido.exe
-
Size
185KB
-
MD5
4abe1482b72bc41218cfa12516674b21
-
SHA1
f3f228fe5c3bd9a903cfe891ea46ecfbe69de784
-
SHA256
ba1c5f36a287271ae64d7fb5e803ced708a75ac3398448f8c3000cf9f2897f86
-
SHA512
256da1cb7be9e593325b23056c9fd10b6c274eb4e5d673186b97a92347b2b36c4c38e324c5e8d489e638b943a114e7f16cbfb7352b44eb6fdfc5cb037a081a2c
Malware Config
Extracted
asyncrat
0.5.7B
GOD'S MERCY
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/reQxa5Ah
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MAJDALANI INOX SA Pedido.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX SA Pedido.exe\"" MAJDALANI INOX SA Pedido.exe -
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1336-134-0x0000000000400000-0x0000000000428000-memory.dmp asyncrat -
Drops startup file 2 IoCs
Processes:
MAJDALANI INOX SA Pedido.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX SA Pedido.exe MAJDALANI INOX SA Pedido.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX SA Pedido.exe MAJDALANI INOX SA Pedido.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MAJDALANI INOX SA Pedido.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MAJDALANI INOX SA Pedido.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX SA Pedido.exe" MAJDALANI INOX SA Pedido.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
MAJDALANI INOX SA Pedido.exedescription pid process target process PID 4576 set thread context of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
installutil.exedescription pid process Token: SeDebugPrivilege 1336 installutil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
MAJDALANI INOX SA Pedido.exedescription pid process target process PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe PID 4576 wrote to memory of 1336 4576 MAJDALANI INOX SA Pedido.exe installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX SA Pedido.exe"C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX SA Pedido.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-133-0x0000000000000000-mapping.dmp
-
memory/1336-134-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4576-130-0x0000000000230000-0x0000000000262000-memory.dmpFilesize
200KB
-
memory/4576-131-0x0000000004C10000-0x0000000004CAC000-memory.dmpFilesize
624KB
-
memory/4576-132-0x0000000005330000-0x00000000058D4000-memory.dmpFilesize
5.6MB