Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 22:46
Static task
static1
Behavioral task
behavioral1
Sample
Ord20211310570045368963AC.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
Ord20211310570045368963AC.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Ord20211310570045368964AL.exe
Resource
win7-20240221-en
General
-
Target
Ord20211310570045368964AL.exe
-
Size
474KB
-
MD5
0cb1c28aaae7fb100c41281e5c9b6c2b
-
SHA1
8e417c1400cac2182f5bc92457d34753e2f9dc23
-
SHA256
966f2e804c9e63e6bbc3d7dda36de1e2ca1fb4b93b4fe95bcfe4b682399ca4ce
-
SHA512
e8cb29368fbc13ef6a8b4e078b8310aaffc9845e73bfaa83e414b998548d9ace3e16ffa3e36efc902a43b1c36bf06fb909e81c0b5adc248da6cb05edc8896621
-
SSDEEP
12288:lOPUPk5+jcIK7GaUv7WaFbMPiyOn8pNISB:lcUP++jcIKqaUjWmwJpNFB
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:3578
194.127.178.3:6606
194.127.178.3:7707
194.127.178.3:8808
194.127.178.3:3578
aliensoldier.duckdns.org:6606
aliensoldier.duckdns.org:7707
aliensoldier.duckdns.org:8808
aliensoldier.duckdns.org:3578
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Ord20211310570045368964AL.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation Ord20211310570045368964AL.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Ord20211310570045368964AL.exedescription pid process target process PID 4528 set thread context of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4976 powershell.exe 4976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4976 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Ord20211310570045368964AL.exedescription pid process target process PID 4528 wrote to memory of 4976 4528 Ord20211310570045368964AL.exe powershell.exe PID 4528 wrote to memory of 4976 4528 Ord20211310570045368964AL.exe powershell.exe PID 4528 wrote to memory of 4976 4528 Ord20211310570045368964AL.exe powershell.exe PID 4528 wrote to memory of 4168 4528 Ord20211310570045368964AL.exe schtasks.exe PID 4528 wrote to memory of 4168 4528 Ord20211310570045368964AL.exe schtasks.exe PID 4528 wrote to memory of 4168 4528 Ord20211310570045368964AL.exe schtasks.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe PID 4528 wrote to memory of 1640 4528 Ord20211310570045368964AL.exe Ord20211310570045368964AL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ord20211310570045368964AL.exe"C:\Users\Admin\AppData\Local\Temp\Ord20211310570045368964AL.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ord20211310570045368964AL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ijYAwqtAYqm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BBE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Ord20211310570045368964AL.exe"C:\Users\Admin\AppData\Local\Temp\Ord20211310570045368964AL.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adgyihh3.ucz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1640-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1640-21-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/1640-67-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/1640-68-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/4528-4-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4528-6-0x00000000060F0000-0x00000000060FA000-memory.dmpFilesize
40KB
-
memory/4528-7-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4528-8-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/4528-9-0x0000000006430000-0x00000000064CC000-memory.dmpFilesize
624KB
-
memory/4528-10-0x0000000006580000-0x00000000065DA000-memory.dmpFilesize
360KB
-
memory/4528-5-0x0000000004ED0000-0x0000000004EDA000-memory.dmpFilesize
40KB
-
memory/4528-0-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4528-3-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/4528-20-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4528-2-0x00000000053C0000-0x0000000005964000-memory.dmpFilesize
5.6MB
-
memory/4528-1-0x00000000003A0000-0x000000000041C000-memory.dmpFilesize
496KB
-
memory/4976-28-0x0000000005C80000-0x0000000005FD4000-memory.dmpFilesize
3.3MB
-
memory/4976-53-0x0000000006820000-0x000000000683E000-memory.dmpFilesize
120KB
-
memory/4976-25-0x0000000005190000-0x00000000051B2000-memory.dmpFilesize
136KB
-
memory/4976-26-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/4976-27-0x0000000005C10000-0x0000000005C76000-memory.dmpFilesize
408KB
-
memory/4976-22-0x0000000002930000-0x0000000002940000-memory.dmpFilesize
64KB
-
memory/4976-23-0x0000000005310000-0x0000000005938000-memory.dmpFilesize
6.2MB
-
memory/4976-38-0x0000000006280000-0x000000000629E000-memory.dmpFilesize
120KB
-
memory/4976-39-0x0000000006310000-0x000000000635C000-memory.dmpFilesize
304KB
-
memory/4976-40-0x0000000002930000-0x0000000002940000-memory.dmpFilesize
64KB
-
memory/4976-41-0x0000000006840000-0x0000000006872000-memory.dmpFilesize
200KB
-
memory/4976-43-0x0000000071060000-0x00000000710AC000-memory.dmpFilesize
304KB
-
memory/4976-42-0x000000007FDD0000-0x000000007FDE0000-memory.dmpFilesize
64KB
-
memory/4976-24-0x0000000002930000-0x0000000002940000-memory.dmpFilesize
64KB
-
memory/4976-54-0x0000000007250000-0x00000000072F3000-memory.dmpFilesize
652KB
-
memory/4976-55-0x0000000007BD0000-0x000000000824A000-memory.dmpFilesize
6.5MB
-
memory/4976-56-0x0000000007580000-0x000000000759A000-memory.dmpFilesize
104KB
-
memory/4976-57-0x00000000075F0000-0x00000000075FA000-memory.dmpFilesize
40KB
-
memory/4976-58-0x0000000007800000-0x0000000007896000-memory.dmpFilesize
600KB
-
memory/4976-59-0x00000000077A0000-0x00000000077B1000-memory.dmpFilesize
68KB
-
memory/4976-60-0x00000000077D0000-0x00000000077DE000-memory.dmpFilesize
56KB
-
memory/4976-61-0x00000000077E0000-0x00000000077F4000-memory.dmpFilesize
80KB
-
memory/4976-62-0x00000000078D0000-0x00000000078EA000-memory.dmpFilesize
104KB
-
memory/4976-63-0x00000000078C0000-0x00000000078C8000-memory.dmpFilesize
32KB
-
memory/4976-66-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4976-18-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4976-17-0x0000000002940000-0x0000000002976000-memory.dmpFilesize
216KB