Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Invoice ID-(679789789).vbs
Resource
win7v20201028
General
-
Target
Invoice ID-(679789789).vbs
-
Size
790KB
-
MD5
f02bd913e532f0ce5cc24adc82f8d0b3
-
SHA1
49fb5baaa600a5208ba80e18bf89142c3f20b4ab
-
SHA256
ee6aa50f61c71ad0a85d0c60e8cec35c45b949da9e173d79cdcb9c7586ac4e12
-
SHA512
64537b7b8b0fb21f41727c99bf6c8da7edc1f4a161a3d11da726c7e2f5b1cb653827ae6c2eba3dbe4ce2a618f839972c36e0cfc915f012b42b5d6d3d75ad3ea6
Malware Config
Extracted
asyncrat
0.5.7B
ahmed21018.linkpc.net:6666
AsyncMutex_6SI8OkPnk
-
aes_key
HfV4Y9fCgIsC3FKVpoDmniTLvXYcA64a
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
ahmed21018.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6666
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3812-8-0x00000000024D0000-0x00000000024DC000-memory.dmp asyncrat behavioral2/memory/1572-26-0x0000000000AB0000-0x0000000000AD0000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
57yhyh.ExEjava updater.exepid process 3812 57yhyh.ExE 1572 java updater.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1836 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
57yhyh.ExEpid process 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE 3812 57yhyh.ExE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
57yhyh.ExEjava updater.exedescription pid process Token: SeDebugPrivilege 3812 57yhyh.ExE Token: SeDebugPrivilege 1572 java updater.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
WScript.exe57yhyh.ExEcmd.execmd.exedescription pid process target process PID 648 wrote to memory of 3812 648 WScript.exe 57yhyh.ExE PID 648 wrote to memory of 3812 648 WScript.exe 57yhyh.ExE PID 648 wrote to memory of 3812 648 WScript.exe 57yhyh.ExE PID 3812 wrote to memory of 3672 3812 57yhyh.ExE cmd.exe PID 3812 wrote to memory of 3672 3812 57yhyh.ExE cmd.exe PID 3812 wrote to memory of 3672 3812 57yhyh.ExE cmd.exe PID 3812 wrote to memory of 2544 3812 57yhyh.ExE cmd.exe PID 3812 wrote to memory of 2544 3812 57yhyh.ExE cmd.exe PID 3812 wrote to memory of 2544 3812 57yhyh.ExE cmd.exe PID 3672 wrote to memory of 2236 3672 cmd.exe schtasks.exe PID 3672 wrote to memory of 2236 3672 cmd.exe schtasks.exe PID 3672 wrote to memory of 2236 3672 cmd.exe schtasks.exe PID 2544 wrote to memory of 1836 2544 cmd.exe timeout.exe PID 2544 wrote to memory of 1836 2544 cmd.exe timeout.exe PID 2544 wrote to memory of 1836 2544 cmd.exe timeout.exe PID 2544 wrote to memory of 1572 2544 cmd.exe java updater.exe PID 2544 wrote to memory of 1572 2544 cmd.exe java updater.exe PID 2544 wrote to memory of 1572 2544 cmd.exe java updater.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice ID-(679789789).vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\57yhyh.ExEC:\Users\Admin\AppData\Local\Temp\57yhyh.ExE2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "java updater" /tr '"C:\Users\Admin\AppData\Roaming\java updater.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "java updater" /tr '"C:\Users\Admin\AppData\Roaming\java updater.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpED63.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\java updater.exe"C:\Users\Admin\AppData\Roaming\java updater.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\57yhyh.ExEMD5
cfb2ab64e731d5649ec6c3e10a6d8a68
SHA19b90bd0ff358dc0b593f46f3ce3893676aa72dfb
SHA2564c03ce198ff982b17ffa2da5c94c4715c6ec6e85792669dcd795945b18b8a09f
SHA51230a89d466749e3fb546f8a0343ad063fbc05368d4067dd53f3b5d7d2c7f57c546c6109a636afa2f2f7a35ce7e57bf367812eeb3fad2027d93e262038856fa737
-
C:\Users\Admin\AppData\Local\Temp\57yhyh.ExEMD5
cfb2ab64e731d5649ec6c3e10a6d8a68
SHA19b90bd0ff358dc0b593f46f3ce3893676aa72dfb
SHA2564c03ce198ff982b17ffa2da5c94c4715c6ec6e85792669dcd795945b18b8a09f
SHA51230a89d466749e3fb546f8a0343ad063fbc05368d4067dd53f3b5d7d2c7f57c546c6109a636afa2f2f7a35ce7e57bf367812eeb3fad2027d93e262038856fa737
-
C:\Users\Admin\AppData\Local\Temp\tmpED63.tmp.batMD5
953e17760c608866bd97fa0d5954f819
SHA1816e6e0396409461b776813f1912f46c05a16b14
SHA256cc9e883c50e51450cba5b99f5b49c90fe6a99b27b84e2457461dca47a705b0b4
SHA512a1569ed8bce3783b18d67ae7fdb325d300c89063a0f7e43dbc2bf0627c0618e25f201b0beb3fc6f6daa069e59326c0a41b9f01b908395e736de62e428e1cb133
-
C:\Users\Admin\AppData\Roaming\java updater.exeMD5
cfb2ab64e731d5649ec6c3e10a6d8a68
SHA19b90bd0ff358dc0b593f46f3ce3893676aa72dfb
SHA2564c03ce198ff982b17ffa2da5c94c4715c6ec6e85792669dcd795945b18b8a09f
SHA51230a89d466749e3fb546f8a0343ad063fbc05368d4067dd53f3b5d7d2c7f57c546c6109a636afa2f2f7a35ce7e57bf367812eeb3fad2027d93e262038856fa737
-
C:\Users\Admin\AppData\Roaming\java updater.exeMD5
cfb2ab64e731d5649ec6c3e10a6d8a68
SHA19b90bd0ff358dc0b593f46f3ce3893676aa72dfb
SHA2564c03ce198ff982b17ffa2da5c94c4715c6ec6e85792669dcd795945b18b8a09f
SHA51230a89d466749e3fb546f8a0343ad063fbc05368d4067dd53f3b5d7d2c7f57c546c6109a636afa2f2f7a35ce7e57bf367812eeb3fad2027d93e262038856fa737
-
memory/1572-28-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/1572-25-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/1572-24-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/1572-23-0x0000000005D70000-0x0000000005D71000-memory.dmpFilesize
4KB
-
memory/1572-26-0x0000000000AB0000-0x0000000000AD0000-memory.dmpFilesize
128KB
-
memory/1572-18-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1572-15-0x0000000000000000-mapping.dmp
-
memory/1572-27-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/1836-14-0x0000000000000000-mapping.dmp
-
memory/2236-13-0x0000000000000000-mapping.dmp
-
memory/2544-11-0x0000000000000000-mapping.dmp
-
memory/3672-10-0x0000000000000000-mapping.dmp
-
memory/3812-2-0x0000000000000000-mapping.dmp
-
memory/3812-9-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/3812-8-0x00000000024D0000-0x00000000024DC000-memory.dmpFilesize
48KB
-
memory/3812-6-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3812-5-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB