Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 14:45
Static task
static1
Behavioral task
behavioral1
Sample
Tax Invoice.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tax Invoice.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Tax Invoice.exe
-
Size
239KB
-
MD5
f3e095480b743b91e227a56dc90f961f
-
SHA1
c173a87c984a20bf5e3751351e144a62de4ae269
-
SHA256
762c259cf0068e583cc70d8839c65bb87401de2f926f8306c66d83e7d7cfda8e
-
SHA512
d7fb57e80d720221aeb1674d7aa967e3c87b334f13c76c26e81d22cc0877d4921deffe37670093de83ebcbf488cdf654eadd12ce9cbd97517068621ec3a15de0
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6A
C2
soft.tjsosda.com:1989
sure.spdns.de:1989
hurricane.rapiddns.ru:1989
Mutex
admin2214
Attributes
-
delay
5
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-57-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Tax Invoice.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ggBin = "C:\\Users\\Admin\\AppData\\Local\\ggBinz\\ggBinzbxc.hta" Tax Invoice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Tax Invoice.exedescription pid process target process PID 1016 set thread context of 1120 1016 Tax Invoice.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Tax Invoice.exeInstallUtil.exepid process 1016 Tax Invoice.exe 1016 Tax Invoice.exe 1016 Tax Invoice.exe 1016 Tax Invoice.exe 1016 Tax Invoice.exe 1120 InstallUtil.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Tax Invoice.exepid process 1016 Tax Invoice.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Tax Invoice.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1016 Tax Invoice.exe Token: SeDebugPrivilege 1120 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Tax Invoice.exedescription pid process target process PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe PID 1016 wrote to memory of 1120 1016 Tax Invoice.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Tax Invoice.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-54-0x00000000010A0000-0x00000000010E0000-memory.dmpFilesize
256KB
-
memory/1016-55-0x0000000000360000-0x0000000000378000-memory.dmpFilesize
96KB
-
memory/1016-58-0x00000000003F0000-0x00000000003F3000-memory.dmpFilesize
12KB
-
memory/1120-56-0x000000000040CCEE-mapping.dmp
-
memory/1120-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-59-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB