Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 14:53
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PURCHASE.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
PURCHASE.exe
-
Size
201KB
-
MD5
aa52fd0aa99adfc2583c41bd67b51b7d
-
SHA1
661a6a80a85d7b0e18e143b6b4909d347d2d438d
-
SHA256
87f439c9aa08113e367a322741a35e2c656a88e9d85e9dacdaf5157ada76f205
-
SHA512
d24c1fa34934f989cc644b68522932380fa1957ff3213b1b352c6de9684453eceec0d5f6f1ef98321cf581659b80feb9755298761c32a07b4d8820aa19f78f3a
Malware Config
Extracted
Family
asyncrat
Version
0.5.6B
C2
winx.xcapdatap.capetown:6204
Mutex
hmbjrgljbnj
Attributes
-
delay
5
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1760-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1760-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1760-66-0x000000000040C15E-mapping.dmp asyncrat behavioral1/memory/1760-68-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1760-70-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Drops startup file 2 IoCs
Processes:
PURCHASE.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\note.exe PURCHASE.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\note.exe PURCHASE.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PURCHASE.exedescription pid process target process PID 1972 set thread context of 1760 1972 PURCHASE.exe PURCHASE.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
PURCHASE.exepid process 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe 1972 PURCHASE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PURCHASE.exedescription pid process Token: SeDebugPrivilege 1972 PURCHASE.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PURCHASE.exedescription pid process target process PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe PID 1972 wrote to memory of 1760 1972 PURCHASE.exe PURCHASE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-66-0x000000000040C15E-mapping.dmp
-
memory/1760-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1972-55-0x00000000003F0000-0x000000000041C000-memory.dmpFilesize
176KB
-
memory/1972-54-0x0000000000BB0000-0x0000000000BEA000-memory.dmpFilesize
232KB
-
memory/1972-59-0x00000000021A0000-0x00000000021A8000-memory.dmpFilesize
32KB
-
memory/1972-58-0x0000000002070000-0x000000000207C000-memory.dmpFilesize
48KB
-
memory/1972-57-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1972-56-0x00000000009C0000-0x00000000009CA000-memory.dmpFilesize
40KB