General
Target

New Purchase Order.exe

Filesize

287KB

Completed

21-05-2022 18:57

Task

behavioral1

Score
10/10
MD5

072c089d4dbca02a4ae028d984f4cc03

SHA1

3bd3b2dd8b8876c64bf528ee503c5ff2a893f897

SHA256

4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c

SHA512

3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

freshg.ddns.net:2256

Attributes
delay
3
install
true
install_file
logs.exe
install_folder
%AppData%
aes.plain
Signatures 11

Filter: none

Discovery
Persistence
  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1952-60-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1952-61-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1952-62-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1952-63-0x000000000040C72E-mapping.dmpasyncrat
    behavioral1/memory/1952-65-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1952-67-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1000-89-0x000000000040C72E-mapping.dmpasyncrat
    behavioral1/memory/1000-93-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
    behavioral1/memory/1000-95-0x0000000000400000-0x0000000000412000-memory.dmpasyncrat
  • Executes dropped EXE
    logs.exelogs.exe

    Reported IOCs

    pidprocess
    1484logs.exe
    1000logs.exe
  • Loads dropped DLL
    cmd.exe

    Reported IOCs

    pidprocess
    108cmd.exe
  • Suspicious use of SetThreadContext
    New Purchase Order.exelogs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 632 set thread context of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 1484 set thread context of 10001484logs.exelogs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1652schtasks.exe
  • Delays execution with timeout.exe
    timeout.exe

    Tags

    Reported IOCs

    pidprocess
    2024timeout.exe
  • Suspicious behavior: EnumeratesProcesses
    New Purchase Order.exePowershell.exeNew Purchase Order.exelogs.exePowershell.exe

    Reported IOCs

    pidprocess
    632New Purchase Order.exe
    632New Purchase Order.exe
    1268Powershell.exe
    1952New Purchase Order.exe
    1484logs.exe
    1484logs.exe
    1844Powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    New Purchase Order.exePowershell.exeNew Purchase Order.exelogs.exePowershell.exelogs.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege632New Purchase Order.exe
    Token: SeDebugPrivilege1268Powershell.exe
    Token: SeDebugPrivilege1952New Purchase Order.exe
    Token: SeDebugPrivilege1484logs.exe
    Token: SeDebugPrivilege1844Powershell.exe
    Token: SeDebugPrivilege1000logs.exe
  • Suspicious use of WriteProcessMemory
    New Purchase Order.exeNew Purchase Order.execmd.execmd.exelogs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1952632New Purchase Order.exeNew Purchase Order.exe
    PID 632 wrote to memory of 1268632New Purchase Order.exePowershell.exe
    PID 632 wrote to memory of 1268632New Purchase Order.exePowershell.exe
    PID 632 wrote to memory of 1268632New Purchase Order.exePowershell.exe
    PID 632 wrote to memory of 1268632New Purchase Order.exePowershell.exe
    PID 1952 wrote to memory of 2681952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 2681952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 2681952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 2681952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 1081952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 1081952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 1081952New Purchase Order.execmd.exe
    PID 1952 wrote to memory of 1081952New Purchase Order.execmd.exe
    PID 268 wrote to memory of 1652268cmd.exeschtasks.exe
    PID 268 wrote to memory of 1652268cmd.exeschtasks.exe
    PID 268 wrote to memory of 1652268cmd.exeschtasks.exe
    PID 268 wrote to memory of 1652268cmd.exeschtasks.exe
    PID 108 wrote to memory of 2024108cmd.exetimeout.exe
    PID 108 wrote to memory of 2024108cmd.exetimeout.exe
    PID 108 wrote to memory of 2024108cmd.exetimeout.exe
    PID 108 wrote to memory of 2024108cmd.exetimeout.exe
    PID 108 wrote to memory of 1484108cmd.exelogs.exe
    PID 108 wrote to memory of 1484108cmd.exelogs.exe
    PID 108 wrote to memory of 1484108cmd.exelogs.exe
    PID 108 wrote to memory of 1484108cmd.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 10001484logs.exelogs.exe
    PID 1484 wrote to memory of 18441484logs.exePowershell.exe
    PID 1484 wrote to memory of 18441484logs.exePowershell.exe
    PID 1484 wrote to memory of 18441484logs.exePowershell.exe
    PID 1484 wrote to memory of 18441484logs.exePowershell.exe
Processes 10
  • C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe
      "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit
        Suspicious use of WriteProcessMemory
        PID:268
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'
          Creates scheduled task(s)
          PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp453B.tmp.bat""
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:108
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:2024
        • C:\Users\Admin\AppData\Roaming\logs.exe
          "C:\Users\Admin\AppData\Roaming\logs.exe"
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:1484
          • C:\Users\Admin\AppData\Roaming\logs.exe
            "C:\Users\Admin\AppData\Roaming\logs.exe"
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:1000
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
            "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:1844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1268
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp453B.tmp.bat

                        MD5

                        188c7442bd2ebd07bf49cdcf27843bb1

                        SHA1

                        ce079285611588d049d61b025ec7d93769ef459b

                        SHA256

                        a7fcc05c29c3dadf0242c91d1b0331070655352d265191e7e1287e9e0e72fccc

                        SHA512

                        33064212209cbef63e81d27ac91dbf6367e087a2fdd83ab13d0faa4264d07d6d4a2490c6b0150e59d4f0eb065259314b15126174daeee41f5cb4bf38dc243136

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                        MD5

                        6e48a0f4903e654e810a94552ec61540

                        SHA1

                        8e5527c535cebe5f228b76d45458ba5c213e0656

                        SHA256

                        77e7bb8f7a1bf5f1e66fd7296058d07ba4ca776a51904843d62369d3468af1d8

                        SHA512

                        0863e6cf097e3040bd154e05e2c3a940683fbdd109f3599940027336f776af9ae559239de41fc3a2fc8b5cf239daaa9cea2dbd6f4d9199200e22e5b69e646658

                      • C:\Users\Admin\AppData\Roaming\logs.exe

                        MD5

                        072c089d4dbca02a4ae028d984f4cc03

                        SHA1

                        3bd3b2dd8b8876c64bf528ee503c5ff2a893f897

                        SHA256

                        4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c

                        SHA512

                        3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac

                      • C:\Users\Admin\AppData\Roaming\logs.exe

                        MD5

                        072c089d4dbca02a4ae028d984f4cc03

                        SHA1

                        3bd3b2dd8b8876c64bf528ee503c5ff2a893f897

                        SHA256

                        4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c

                        SHA512

                        3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac

                      • C:\Users\Admin\AppData\Roaming\logs.exe

                        MD5

                        072c089d4dbca02a4ae028d984f4cc03

                        SHA1

                        3bd3b2dd8b8876c64bf528ee503c5ff2a893f897

                        SHA256

                        4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c

                        SHA512

                        3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac

                      • \Users\Admin\AppData\Roaming\logs.exe

                        MD5

                        072c089d4dbca02a4ae028d984f4cc03

                        SHA1

                        3bd3b2dd8b8876c64bf528ee503c5ff2a893f897

                        SHA256

                        4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c

                        SHA512

                        3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac

                      • memory/108-73-0x0000000000000000-mapping.dmp

                      • memory/268-72-0x0000000000000000-mapping.dmp

                      • memory/632-55-0x0000000075391000-0x0000000075393000-memory.dmp

                      • memory/632-56-0x00000000004E0000-0x0000000000518000-memory.dmp

                      • memory/632-54-0x0000000001300000-0x000000000134C000-memory.dmp

                      • memory/1000-95-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1000-89-0x000000000040C72E-mapping.dmp

                      • memory/1000-93-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1268-70-0x0000000072490000-0x0000000072A3B000-memory.dmp

                      • memory/1268-68-0x0000000000000000-mapping.dmp

                      • memory/1484-81-0x00000000001B0000-0x00000000001FC000-memory.dmp

                      • memory/1484-79-0x0000000000000000-mapping.dmp

                      • memory/1652-74-0x0000000000000000-mapping.dmp

                      • memory/1844-98-0x0000000073820000-0x0000000073DCB000-memory.dmp

                      • memory/1844-92-0x0000000000000000-mapping.dmp

                      • memory/1952-61-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-67-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-65-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-63-0x000000000040C72E-mapping.dmp

                      • memory/1952-60-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-58-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-57-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/1952-62-0x0000000000400000-0x0000000000412000-memory.dmp

                      • memory/2024-76-0x0000000000000000-mapping.dmp