Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:55
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Order.exe
Resource
win7-20220414-en
General
-
Target
New Purchase Order.exe
-
Size
287KB
-
MD5
072c089d4dbca02a4ae028d984f4cc03
-
SHA1
3bd3b2dd8b8876c64bf528ee503c5ff2a893f897
-
SHA256
4c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c
-
SHA512
3f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac
Malware Config
Extracted
asyncrat
0.5.7B
Default
freshg.ddns.net:2256
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
logs.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-60-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1952-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1952-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1952-63-0x000000000040C72E-mapping.dmp asyncrat behavioral1/memory/1952-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1952-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1000-89-0x000000000040C72E-mapping.dmp asyncrat behavioral1/memory/1000-93-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1000-95-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
logs.exelogs.exepid process 1484 logs.exe 1000 logs.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 108 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
New Purchase Order.exelogs.exedescription pid process target process PID 632 set thread context of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 1484 set thread context of 1000 1484 logs.exe logs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2024 timeout.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
New Purchase Order.exePowershell.exeNew Purchase Order.exelogs.exePowershell.exepid process 632 New Purchase Order.exe 632 New Purchase Order.exe 1268 Powershell.exe 1952 New Purchase Order.exe 1484 logs.exe 1484 logs.exe 1844 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
New Purchase Order.exePowershell.exeNew Purchase Order.exelogs.exePowershell.exelogs.exedescription pid process Token: SeDebugPrivilege 632 New Purchase Order.exe Token: SeDebugPrivilege 1268 Powershell.exe Token: SeDebugPrivilege 1952 New Purchase Order.exe Token: SeDebugPrivilege 1484 logs.exe Token: SeDebugPrivilege 1844 Powershell.exe Token: SeDebugPrivilege 1000 logs.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
New Purchase Order.exeNew Purchase Order.execmd.execmd.exelogs.exedescription pid process target process PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1952 632 New Purchase Order.exe New Purchase Order.exe PID 632 wrote to memory of 1268 632 New Purchase Order.exe Powershell.exe PID 632 wrote to memory of 1268 632 New Purchase Order.exe Powershell.exe PID 632 wrote to memory of 1268 632 New Purchase Order.exe Powershell.exe PID 632 wrote to memory of 1268 632 New Purchase Order.exe Powershell.exe PID 1952 wrote to memory of 268 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 268 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 268 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 268 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 108 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 108 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 108 1952 New Purchase Order.exe cmd.exe PID 1952 wrote to memory of 108 1952 New Purchase Order.exe cmd.exe PID 268 wrote to memory of 1652 268 cmd.exe schtasks.exe PID 268 wrote to memory of 1652 268 cmd.exe schtasks.exe PID 268 wrote to memory of 1652 268 cmd.exe schtasks.exe PID 268 wrote to memory of 1652 268 cmd.exe schtasks.exe PID 108 wrote to memory of 2024 108 cmd.exe timeout.exe PID 108 wrote to memory of 2024 108 cmd.exe timeout.exe PID 108 wrote to memory of 2024 108 cmd.exe timeout.exe PID 108 wrote to memory of 2024 108 cmd.exe timeout.exe PID 108 wrote to memory of 1484 108 cmd.exe logs.exe PID 108 wrote to memory of 1484 108 cmd.exe logs.exe PID 108 wrote to memory of 1484 108 cmd.exe logs.exe PID 108 wrote to memory of 1484 108 cmd.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1000 1484 logs.exe logs.exe PID 1484 wrote to memory of 1844 1484 logs.exe Powershell.exe PID 1484 wrote to memory of 1844 1484 logs.exe Powershell.exe PID 1484 wrote to memory of 1844 1484 logs.exe Powershell.exe PID 1484 wrote to memory of 1844 1484 logs.exe Powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp453B.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\logs.exe"C:\Users\Admin\AppData\Roaming\logs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\logs.exe"C:\Users\Admin\AppData\Roaming\logs.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp453B.tmp.batFilesize
148B
MD5188c7442bd2ebd07bf49cdcf27843bb1
SHA1ce079285611588d049d61b025ec7d93769ef459b
SHA256a7fcc05c29c3dadf0242c91d1b0331070655352d265191e7e1287e9e0e72fccc
SHA51233064212209cbef63e81d27ac91dbf6367e087a2fdd83ab13d0faa4264d07d6d4a2490c6b0150e59d4f0eb065259314b15126174daeee41f5cb4bf38dc243136
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD56e48a0f4903e654e810a94552ec61540
SHA18e5527c535cebe5f228b76d45458ba5c213e0656
SHA25677e7bb8f7a1bf5f1e66fd7296058d07ba4ca776a51904843d62369d3468af1d8
SHA5120863e6cf097e3040bd154e05e2c3a940683fbdd109f3599940027336f776af9ae559239de41fc3a2fc8b5cf239daaa9cea2dbd6f4d9199200e22e5b69e646658
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
287KB
MD5072c089d4dbca02a4ae028d984f4cc03
SHA13bd3b2dd8b8876c64bf528ee503c5ff2a893f897
SHA2564c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c
SHA5123f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
287KB
MD5072c089d4dbca02a4ae028d984f4cc03
SHA13bd3b2dd8b8876c64bf528ee503c5ff2a893f897
SHA2564c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c
SHA5123f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac
-
C:\Users\Admin\AppData\Roaming\logs.exeFilesize
287KB
MD5072c089d4dbca02a4ae028d984f4cc03
SHA13bd3b2dd8b8876c64bf528ee503c5ff2a893f897
SHA2564c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c
SHA5123f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac
-
\Users\Admin\AppData\Roaming\logs.exeFilesize
287KB
MD5072c089d4dbca02a4ae028d984f4cc03
SHA13bd3b2dd8b8876c64bf528ee503c5ff2a893f897
SHA2564c66ebb40e5abd92b6a6985e8409116c5424ebb9af0c320cbafb031698e5022c
SHA5123f2988a4f256e1b4cb07af531798d7d3bd445f27a81aecf15f200cc8aa1c2fdaff591e9865965468d651a7d578808550dfba95d959d74eb7a1abd3c667af67ac
-
memory/108-73-0x0000000000000000-mapping.dmp
-
memory/268-72-0x0000000000000000-mapping.dmp
-
memory/632-55-0x0000000075391000-0x0000000075393000-memory.dmpFilesize
8KB
-
memory/632-56-0x00000000004E0000-0x0000000000518000-memory.dmpFilesize
224KB
-
memory/632-54-0x0000000001300000-0x000000000134C000-memory.dmpFilesize
304KB
-
memory/1000-89-0x000000000040C72E-mapping.dmp
-
memory/1000-95-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1000-93-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1268-68-0x0000000000000000-mapping.dmp
-
memory/1268-70-0x0000000072490000-0x0000000072A3B000-memory.dmpFilesize
5.7MB
-
memory/1484-81-0x00000000001B0000-0x00000000001FC000-memory.dmpFilesize
304KB
-
memory/1484-79-0x0000000000000000-mapping.dmp
-
memory/1652-74-0x0000000000000000-mapping.dmp
-
memory/1844-92-0x0000000000000000-mapping.dmp
-
memory/1844-98-0x0000000073820000-0x0000000073DCB000-memory.dmpFilesize
5.7MB
-
memory/1952-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1952-63-0x000000000040C72E-mapping.dmp
-
memory/1952-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-76-0x0000000000000000-mapping.dmp