Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-PO#20222906.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ-PO#20222906.js
Resource
win10v2004-20220414-en
General
-
Target
RFQ-PO#20222906.js
-
Size
197KB
-
MD5
558ced74df141e2e8f4a340edccd5e16
-
SHA1
09e29290df81916a3621bcde3c467b1af2228a24
-
SHA256
b090d245e1cc85444c011b6b6c9c73dfa85f8e1ff5f3449d2e807552c7db6f7d
-
SHA512
9ffc284caf3c745831b38445cfed7c664559bfb0f86348c844fc0ab4542180c7389efe61c3f0f9aeb7dbe398f7a8b147d9d0e69b3da3d9d080fea35458d4f3be
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral1/memory/1592-68-0x0000000001330000-0x0000000001342000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat behavioral1/memory/952-79-0x0000000001160000-0x0000000001172000-memory.dmp asyncrat -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 5 1696 wscript.exe 10 1696 wscript.exe 16 1696 wscript.exe 22 1696 wscript.exe 27 1696 wscript.exe 33 1696 wscript.exe -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 1592 AsyncClient.exe 952 win.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.js wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 108 cmd.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1284 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 1592 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 1592 AsyncClient.exe Token: SeDebugPrivilege 952 win.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
wscript.exewscript.exewscript.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 1280 wrote to memory of 1508 1280 wscript.exe wscript.exe PID 1280 wrote to memory of 1508 1280 wscript.exe wscript.exe PID 1280 wrote to memory of 1508 1280 wscript.exe wscript.exe PID 1280 wrote to memory of 1696 1280 wscript.exe wscript.exe PID 1280 wrote to memory of 1696 1280 wscript.exe wscript.exe PID 1280 wrote to memory of 1696 1280 wscript.exe wscript.exe PID 1696 wrote to memory of 304 1696 wscript.exe wscript.exe PID 1696 wrote to memory of 304 1696 wscript.exe wscript.exe PID 1696 wrote to memory of 304 1696 wscript.exe wscript.exe PID 1508 wrote to memory of 1592 1508 wscript.exe AsyncClient.exe PID 1508 wrote to memory of 1592 1508 wscript.exe AsyncClient.exe PID 1508 wrote to memory of 1592 1508 wscript.exe AsyncClient.exe PID 1508 wrote to memory of 1592 1508 wscript.exe AsyncClient.exe PID 1592 wrote to memory of 1496 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 1496 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 1496 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 1496 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 108 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 108 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 108 1592 AsyncClient.exe cmd.exe PID 1592 wrote to memory of 108 1592 AsyncClient.exe cmd.exe PID 1496 wrote to memory of 1060 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 1060 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 1060 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 1060 1496 cmd.exe schtasks.exe PID 108 wrote to memory of 1284 108 cmd.exe timeout.exe PID 108 wrote to memory of 1284 108 cmd.exe timeout.exe PID 108 wrote to memory of 1284 108 cmd.exe timeout.exe PID 108 wrote to memory of 1284 108 cmd.exe timeout.exe PID 108 wrote to memory of 952 108 cmd.exe win.exe PID 108 wrote to memory of 952 108 cmd.exe win.exe PID 108 wrote to memory of 952 108 cmd.exe win.exe PID 108 wrote to memory of 952 108 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-PO#20222906.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp18BF.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RFQ-PO#20222906.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp18BF.tmp.batFilesize
147B
MD5259d91395cb63e1ae80b29c85f4ed3f7
SHA17023e796d0181a8971779604e3d94d0d540e9635
SHA2560379bc39487944e63ffb9140e8038257ae88f6a5fdde44caec925b4a930c3d5d
SHA512656dd65a1be595bdf1346982a1fcf65a5980f7b67188c8067f81780a0e719dfb6acdfbe35e417edae9e5d81f956280695f687f1a5b64d1797d52d0864eb5d6f8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.jsFilesize
197KB
MD5558ced74df141e2e8f4a340edccd5e16
SHA109e29290df81916a3621bcde3c467b1af2228a24
SHA256b090d245e1cc85444c011b6b6c9c73dfa85f8e1ff5f3449d2e807552c7db6f7d
SHA5129ffc284caf3c745831b38445cfed7c664559bfb0f86348c844fc0ab4542180c7389efe61c3f0f9aeb7dbe398f7a8b147d9d0e69b3da3d9d080fea35458d4f3be
-
C:\Users\Admin\AppData\Roaming\RFQ-PO#20222906.jsFilesize
197KB
MD5558ced74df141e2e8f4a340edccd5e16
SHA109e29290df81916a3621bcde3c467b1af2228a24
SHA256b090d245e1cc85444c011b6b6c9c73dfa85f8e1ff5f3449d2e807552c7db6f7d
SHA5129ffc284caf3c745831b38445cfed7c664559bfb0f86348c844fc0ab4542180c7389efe61c3f0f9aeb7dbe398f7a8b147d9d0e69b3da3d9d080fea35458d4f3be
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/108-71-0x0000000000000000-mapping.dmp
-
memory/304-61-0x0000000000000000-mapping.dmp
-
memory/952-77-0x0000000000000000-mapping.dmp
-
memory/952-79-0x0000000001160000-0x0000000001172000-memory.dmpFilesize
72KB
-
memory/1060-72-0x0000000000000000-mapping.dmp
-
memory/1280-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmpFilesize
8KB
-
memory/1284-74-0x0000000000000000-mapping.dmp
-
memory/1496-70-0x0000000000000000-mapping.dmp
-
memory/1508-55-0x0000000000000000-mapping.dmp
-
memory/1592-69-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/1592-68-0x0000000001330000-0x0000000001342000-memory.dmpFilesize
72KB
-
memory/1592-64-0x0000000000000000-mapping.dmp
-
memory/1696-56-0x0000000000000000-mapping.dmp