Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 12:46
Static task
static1
Behavioral task
behavioral1
Sample
ORDINE.exe
Resource
win7-20220715-en
General
-
Target
ORDINE.exe
-
Size
3.0MB
-
MD5
30e619eed663b6696ba1269dec11e1a9
-
SHA1
04ad1454bb163c8e1c5820ba591ae613dd6f6d45
-
SHA256
faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
-
SHA512
2c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
Malware Config
Extracted
asyncrat
0.5.7B
Alibaba
191.101.130.243:7707
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/492-137-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 4828 iexplore.exe 2652 iexplore.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
ORDINE.exeiexplore.exeiexplore.exedescription pid process target process PID 3900 set thread context of 492 3900 ORDINE.exe vbc.exe PID 4828 set thread context of 652 4828 iexplore.exe vbc.exe PID 2652 set thread context of 2196 2652 iexplore.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1336 schtasks.exe 4368 schtasks.exe 4176 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ORDINE.exevbc.exeiexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 3900 ORDINE.exe Token: SeDebugPrivilege 492 vbc.exe Token: SeDebugPrivilege 4828 iexplore.exe Token: SeDebugPrivilege 2652 iexplore.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
ORDINE.execmd.exeiexplore.execmd.exeiexplore.execmd.exedescription pid process target process PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 492 3900 ORDINE.exe vbc.exe PID 3900 wrote to memory of 460 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 460 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 460 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 4052 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 4052 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 4052 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 1920 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 1920 3900 ORDINE.exe cmd.exe PID 3900 wrote to memory of 1920 3900 ORDINE.exe cmd.exe PID 4052 wrote to memory of 1336 4052 cmd.exe schtasks.exe PID 4052 wrote to memory of 1336 4052 cmd.exe schtasks.exe PID 4052 wrote to memory of 1336 4052 cmd.exe schtasks.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 652 4828 iexplore.exe vbc.exe PID 4828 wrote to memory of 2380 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 2380 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 2380 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 408 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 408 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 408 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 3368 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 3368 4828 iexplore.exe cmd.exe PID 4828 wrote to memory of 3368 4828 iexplore.exe cmd.exe PID 408 wrote to memory of 4368 408 cmd.exe schtasks.exe PID 408 wrote to memory of 4368 408 cmd.exe schtasks.exe PID 408 wrote to memory of 4368 408 cmd.exe schtasks.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 2196 2652 iexplore.exe vbc.exe PID 2652 wrote to memory of 4424 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 4424 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 4424 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 4728 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 4728 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 4728 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 408 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 408 2652 iexplore.exe cmd.exe PID 2652 wrote to memory of 408 2652 iexplore.exe cmd.exe PID 4728 wrote to memory of 4176 4728 cmd.exe schtasks.exe PID 4728 wrote to memory of 4176 4728 cmd.exe schtasks.exe PID 4728 wrote to memory of 4176 4728 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDINE.exe"C:\Users\Admin\AppData\Local\Temp\ORDINE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ORDINE.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeC:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeC:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\iexplore"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iexplore.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
C:\Users\Admin\AppData\Local\Temp\iexplore\iexplore.exeFilesize
3.0MB
MD530e619eed663b6696ba1269dec11e1a9
SHA104ad1454bb163c8e1c5820ba591ae613dd6f6d45
SHA256faaddcf1294c8358fc6ccc4c36ecdc9fccd03ac345b3d022db144798d611397d
SHA5122c7ff7b8658137e4c1ce494b2944e41c51be8c5d163df07cc3b16736d3abf591ea530d2b4b5fca212fc96d72383a4e65bfe42491a938dc12b42e78b764439bb3
-
memory/408-151-0x0000000000000000-mapping.dmp
-
memory/408-161-0x0000000000000000-mapping.dmp
-
memory/460-138-0x0000000000000000-mapping.dmp
-
memory/492-143-0x0000000005820000-0x0000000005DC4000-memory.dmpFilesize
5.6MB
-
memory/492-144-0x0000000005270000-0x00000000052D6000-memory.dmpFilesize
408KB
-
memory/492-142-0x0000000004F40000-0x0000000004FDC000-memory.dmpFilesize
624KB
-
memory/492-137-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/492-136-0x0000000000000000-mapping.dmp
-
memory/652-148-0x0000000000000000-mapping.dmp
-
memory/1336-141-0x0000000000000000-mapping.dmp
-
memory/1920-140-0x0000000000000000-mapping.dmp
-
memory/2196-156-0x0000000000000000-mapping.dmp
-
memory/2380-150-0x0000000000000000-mapping.dmp
-
memory/3368-152-0x0000000000000000-mapping.dmp
-
memory/3900-135-0x0000000000A70000-0x0000000000AEA000-memory.dmpFilesize
488KB
-
memory/4052-139-0x0000000000000000-mapping.dmp
-
memory/4176-162-0x0000000000000000-mapping.dmp
-
memory/4368-153-0x0000000000000000-mapping.dmp
-
memory/4424-158-0x0000000000000000-mapping.dmp
-
memory/4728-160-0x0000000000000000-mapping.dmp
-
memory/4828-147-0x0000000000A20000-0x0000000000A9A000-memory.dmpFilesize
488KB