Analysis
-
max time kernel
124s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 12:46
Static task
static1
Behavioral task
behavioral1
Sample
ORDINE.exe
Resource
win7-20220715-en
General
-
Target
ORDINE.exe
-
Size
3.0MB
-
MD5
30e619eed663b6696ba1269dec11e1a9
-
SHA1
04ad1454bb163c8e1c5820ba591ae613dd6f6d45
-
SHA256
faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
-
SHA512
2c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
Malware Config
Extracted
asyncrat
0.5.7B
Alibaba
191.101.130.243:7707
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-59-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-60-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-61-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-62-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/1968-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1968-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/560-83-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/2024-102-0x000000000040C71E-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1808 iexplore.exe 1280 iexplore.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
ORDINE.exeiexplore.exeiexplore.exedescription pid process target process PID 1876 set thread context of 1968 1876 ORDINE.exe vbc.exe PID 1808 set thread context of 560 1808 iexplore.exe vbc.exe PID 1280 set thread context of 2024 1280 iexplore.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 816 schtasks.exe 1692 schtasks.exe 1020 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ORDINE.exevbc.exeiexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1876 ORDINE.exe Token: SeDebugPrivilege 1968 vbc.exe Token: SeDebugPrivilege 1808 iexplore.exe Token: SeDebugPrivilege 1280 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ORDINE.execmd.exetaskeng.exeiexplore.execmd.exeiexplore.exedescription pid process target process PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1968 1876 ORDINE.exe vbc.exe PID 1876 wrote to memory of 1740 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1740 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1740 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1740 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1736 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1736 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1736 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1736 1876 ORDINE.exe cmd.exe PID 1736 wrote to memory of 1020 1736 cmd.exe schtasks.exe PID 1736 wrote to memory of 1020 1736 cmd.exe schtasks.exe PID 1736 wrote to memory of 1020 1736 cmd.exe schtasks.exe PID 1736 wrote to memory of 1020 1736 cmd.exe schtasks.exe PID 1876 wrote to memory of 1720 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1720 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1720 1876 ORDINE.exe cmd.exe PID 1876 wrote to memory of 1720 1876 ORDINE.exe cmd.exe PID 1480 wrote to memory of 1808 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1808 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1808 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1808 1480 taskeng.exe iexplore.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 560 1808 iexplore.exe vbc.exe PID 1808 wrote to memory of 2000 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 2000 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 2000 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 2000 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 724 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 724 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 724 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 724 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 1552 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 1552 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 1552 1808 iexplore.exe cmd.exe PID 1808 wrote to memory of 1552 1808 iexplore.exe cmd.exe PID 724 wrote to memory of 816 724 cmd.exe schtasks.exe PID 724 wrote to memory of 816 724 cmd.exe schtasks.exe PID 724 wrote to memory of 816 724 cmd.exe schtasks.exe PID 724 wrote to memory of 816 724 cmd.exe schtasks.exe PID 1480 wrote to memory of 1280 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1280 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1280 1480 taskeng.exe iexplore.exe PID 1480 wrote to memory of 1280 1480 taskeng.exe iexplore.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe PID 1280 wrote to memory of 2024 1280 iexplore.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDINE.exe"C:\Users\Admin\AppData\Local\Temp\ORDINE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ORDINE.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {C83C89B4-13E0-490D-B2A3-0447E16394F0} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeC:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeC:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
memory/560-83-0x000000000040C71E-mapping.dmp
-
memory/724-89-0x0000000000000000-mapping.dmp
-
memory/816-91-0x0000000000000000-mapping.dmp
-
memory/1020-69-0x0000000000000000-mapping.dmp
-
memory/1280-93-0x0000000000000000-mapping.dmp
-
memory/1532-103-0x0000000000000000-mapping.dmp
-
memory/1552-90-0x0000000000000000-mapping.dmp
-
memory/1596-109-0x0000000000000000-mapping.dmp
-
memory/1692-110-0x0000000000000000-mapping.dmp
-
memory/1720-70-0x0000000000000000-mapping.dmp
-
memory/1736-68-0x0000000000000000-mapping.dmp
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1808-75-0x0000000000270000-0x00000000002EA000-memory.dmpFilesize
488KB
-
memory/1808-73-0x0000000000000000-mapping.dmp
-
memory/1876-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1876-54-0x0000000000870000-0x00000000008EA000-memory.dmpFilesize
488KB
-
memory/1968-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-62-0x000000000040C71E-mapping.dmp
-
memory/1968-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1968-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2000-88-0x0000000000000000-mapping.dmp
-
memory/2004-108-0x0000000000000000-mapping.dmp
-
memory/2024-102-0x000000000040C71E-mapping.dmp