Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
AWB#5305323204669,pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
AWB#5305323204669,pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
AWB#5305323204669,pdf.exe
-
Size
233KB
-
MD5
dab03f72d77a672205cc10130d2654c6
-
SHA1
83241c5520fdfc26aa7fe4d282f7e7de9018616b
-
SHA256
79125331a3e97dca7542b0f146bcb41429eebf7b790014317463c9239601421a
-
SHA512
1fad7ea231e95080ceef91d02d972db60a8d9096a7d6b3c7d50243b62eb7b07999d1af919787c11f9d3bae8d0fe257e4b97b6fada39e0cf436ef6d00423b5262
Malware Config
Extracted
asyncrat
0.5.7B
AWKASUNDAYNIGHT
chizzy25@!7^UPC
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/HKYwiN9V
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3260-138-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AWB#5305323204669,pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation AWB#5305323204669,pdf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB#5305323204669,pdf.exedescription pid process target process PID 1292 set thread context of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AWB#5305323204669,pdf.exepid process 1292 AWB#5305323204669,pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AWB#5305323204669,pdf.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1292 AWB#5305323204669,pdf.exe Token: SeDebugPrivilege 3260 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
AWB#5305323204669,pdf.exedescription pid process target process PID 1292 wrote to memory of 4528 1292 AWB#5305323204669,pdf.exe schtasks.exe PID 1292 wrote to memory of 4528 1292 AWB#5305323204669,pdf.exe schtasks.exe PID 1292 wrote to memory of 4528 1292 AWB#5305323204669,pdf.exe schtasks.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe PID 1292 wrote to memory of 3260 1292 AWB#5305323204669,pdf.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB#5305323204669,pdf.exe"C:\Users\Admin\AppData\Local\Temp\AWB#5305323204669,pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgIKzElqxTk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B30.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7B30.tmpFilesize
1KB
MD56b7d28cb2499b04059c7f07c81b6c6ab
SHA1fdb27fa3bf448fbf7f1b59e3f66374f42db7e974
SHA2567a87e9540930e15bfb765999c1095a0b28fd9999a6fdbfad7a5c6c08afc27ec4
SHA5120f573c399992d545b7305e2265e8bb9a59c36b669d22649c1143ece14900ad96ef822c6246962d51d04a3124c25733b88a38cd3f459723f8197dc1d925f0db4d
-
memory/1292-130-0x00000000004C0000-0x0000000000500000-memory.dmpFilesize
256KB
-
memory/1292-131-0x0000000007810000-0x0000000007DB4000-memory.dmpFilesize
5.6MB
-
memory/1292-132-0x0000000007360000-0x00000000073F2000-memory.dmpFilesize
584KB
-
memory/1292-133-0x0000000007410000-0x000000000741A000-memory.dmpFilesize
40KB
-
memory/1292-134-0x000000000AD00000-0x000000000AD9C000-memory.dmpFilesize
624KB
-
memory/3260-137-0x0000000000000000-mapping.dmp
-
memory/3260-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3260-139-0x00000000054F0000-0x0000000005556000-memory.dmpFilesize
408KB
-
memory/4528-135-0x0000000000000000-mapping.dmp