Overview

overview

10

Static

static

10

Rfq Attach...(9).js

windows7_x64

10

Rfq Attach...(9).js

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    06/02/2022, 22:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Rfq Attached 202103_Top Urgent (9).js
  • Size 391KB
  • Sample220206-2vav4acehp
  • SHA256 92e7d30a12117e09df1df828f25455892238a636bf076640fcfb65bc5ddde4d6
  • MD5 SHA1 SHA512
Score
10/10
asyncratwshratdefaultpersistencerattrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default

C2

  • Asin8989.ddns.net:8989

  • Asin8989.ddns.net:8988

  • asin8988.ddns.net:8989

  • asin8988.ddns.net:8988

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_file

    Microsoft Handler Services

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • WSHRAT Payload 1 IoCs
  • Async RAT payload 1 IoCs
    rat
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Rfq Attached 202103_Top Urgent (9).js"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Rfq Attached 202103_Top Urgent (9).js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Rfq Attached 202103_Top Urgent (9).vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EXECUTIONPOLICY REMOTESIGNED -FILE C:\Users\Admin\AppData\Local\Temp\Systray64.PS1
          4⤵
          • Drops startup file
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3148
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\giz1nqvd\giz1nqvd.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1928
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFAD.tmp" "c:\Users\Admin\AppData\Local\Temp\giz1nqvd\CSC5F6220482C05472F9C9FD7C828A35BD7.TMP"
              6⤵
                PID:3576
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              5⤵
                PID:1284
      • C:\Windows\system32\MusNotifyIcon.exe
        %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
        1⤵
        • Checks processor information in registry
        PID:3412
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:3892

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1284-156-0x0000000009610000-0x0000000009611000-memory.dmp
            Download

            memory/1284-151-0x0000000000400000-0x0000000000412000-memory.dmp
            Download

            memory/3148-141-0x00000278D3030000-0x00000278D3032000-memory.dmp
            Download

            memory/3148-144-0x00000278D34E0000-0x00000278D3556000-memory.dmp
            Download

            memory/3148-143-0x00000278D3036000-0x00000278D3038000-memory.dmp
            Download

            memory/3148-142-0x00000278D3033000-0x00000278D3035000-memory.dmp
            Download

            memory/3148-137-0x00000278D2F80000-0x00000278D2FA2000-memory.dmp
            Download