asyncrat | 7c8b340626b6330e1a94c98a97b4de4778e996e1f65c4d7cf81f7c1605f66e7d

General

Target

fddaeygXLjAsync.js
Size

119KB
MD5

542b756dd96091a329ef2d11d08a6b3e
SHA1

bebe6cb01c61932081119bcd8c4c35d4c75eabe8
SHA256

7c8b340626b6330e1a94c98a97b4de4778e996e1f65c4d7cf81f7c1605f66e7d
SHA512

ebf79ee53d2c4edeb16bf842e11b91c45717a778de4334305d7276b7dd30718dfef2841a365e5ef8c86d911be7247187b40e2529568d080e3879d33d7342b0e6

Score

10^/10

asyncrat vjw0rm default persistence rat suricata trojan worm

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

104.168.33.53:6606

104.168.33.53:7707

104.168.33.53:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Async.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\Async.exe	asyncrat
behavioral2/memory/4268-135-0x0000000000C00000-0x0000000000C12000-memory.dmp	asyncrat

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
6	4660	wscript.exe
10	4660	wscript.exe
11	4660	wscript.exe
14	4660	wscript.exe
23	4660	wscript.exe
26	4660	wscript.exe
29	4660	wscript.exe
31	4660	wscript.exe
34	4660	wscript.exe
39	4660	wscript.exe
43	4660	wscript.exe
44	4660	wscript.exe
46	4660	wscript.exe
47	4660	wscript.exe
50	4660	wscript.exe
58	4660	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Async.exe

pid process

4268 Async.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe

pid	process
4268	Async.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NUwYwPFpEJ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NUwYwPFpEJ.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\NUwYwPFpEJ.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Async.exe

description pid process

Token: SeDebugPrivilege 4268 Async.exe

description	pid	process
Token: SeDebugPrivilege	4268	Async.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3620 wrote to memory of 4660	3620	wscript.exe	wscript.exe
PID 3620 wrote to memory of 4660	3620	wscript.exe	wscript.exe
PID 3620 wrote to memory of 4268	3620	wscript.exe	Async.exe
PID 3620 wrote to memory of 4268	3620	wscript.exe	Async.exe
PID 3620 wrote to memory of 4268	3620	wscript.exe	Async.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fddaeygXLjAsync.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NUwYwPFpEJ.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4660

C:\Users\Admin\AppData\Local\Temp\Async.exe
"C:\Users\Admin\AppData\Local\Temp\Async.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Async.exe
Filesize
45KB

MD5
65586e22a9a03098c2e3fcc25f552e0f

SHA1
4b643df63515c9ddabcc5ab6b3067b3f77a40ec1

SHA256
a7a86f886a367edb3bb30013d45582babf374a941ef6483f0da25521ecef42d1

SHA512
b06fbd875202104f06c11584ff39fe5f623616a41166de5195446ddb39023bef42d456a2a9bb44fe4f862c163b322734a5f836dec6e0800c636e230dbddc125a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Async.exe
Filesize
45KB

MD5
65586e22a9a03098c2e3fcc25f552e0f

SHA1
4b643df63515c9ddabcc5ab6b3067b3f77a40ec1

SHA256
a7a86f886a367edb3bb30013d45582babf374a941ef6483f0da25521ecef42d1

SHA512
b06fbd875202104f06c11584ff39fe5f623616a41166de5195446ddb39023bef42d456a2a9bb44fe4f862c163b322734a5f836dec6e0800c636e230dbddc125a

Download Submit
C:\Users\Admin\AppData\Roaming\NUwYwPFpEJ.js
Filesize
15KB

MD5
f968c7106fa42c287710c1582e45b546

SHA1
f16aaafe731a57b6dc43380d4999609b89e7822c

SHA256
fc71ed12fa0720f87b95ffa02fd0af75ed35edbf43030f91925be94ac20eae62

SHA512
d606121022b748d4da6a50d56114f46857968829de295a3f4d46aa6fba08dbafec0549ba1c798dba1e45e1f9bdafa59165095e729490556408b4ecca49236432

Download Submit
memory/4268-132-0x0000000000000000-mapping.dmp

Download
memory/4268-135-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/4268-136-0x0000000005F10000-0x0000000005FAC000-memory.dmp

Filesize
624KB

Download
memory/4268-137-0x0000000006560000-0x0000000006B04000-memory.dmp

Filesize
5.6MB

Download
memory/4268-138-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/4660-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads