Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-PO#20222906.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ-PO#20222906.js
Resource
win10v2004-20220414-en
General
-
Target
RFQ-PO#20222906.js
-
Size
197KB
-
MD5
558ced74df141e2e8f4a340edccd5e16
-
SHA1
09e29290df81916a3621bcde3c467b1af2228a24
-
SHA256
b090d245e1cc85444c011b6b6c9c73dfa85f8e1ff5f3449d2e807552c7db6f7d
-
SHA512
9ffc284caf3c745831b38445cfed7c664559bfb0f86348c844fc0ab4542180c7389efe61c3f0f9aeb7dbe398f7a8b147d9d0e69b3da3d9d080fea35458d4f3be
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral2/memory/4764-140-0x00000000001E0000-0x00000000001F2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 6 1444 wscript.exe 13 1444 wscript.exe 38 1444 wscript.exe 45 1444 wscript.exe 51 1444 wscript.exe 57 1444 wscript.exe -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 4764 AsyncClient.exe 2520 win.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exewscript.exewscript.exeAsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ-PO#20222906 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ-PO#20222906.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4296 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
AsyncClient.exepid process 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe 4764 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 4764 AsyncClient.exe Token: SeDebugPrivilege 2520 win.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
wscript.exewscript.exewscript.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 4108 wrote to memory of 3964 4108 wscript.exe wscript.exe PID 4108 wrote to memory of 3964 4108 wscript.exe wscript.exe PID 4108 wrote to memory of 1444 4108 wscript.exe wscript.exe PID 4108 wrote to memory of 1444 4108 wscript.exe wscript.exe PID 1444 wrote to memory of 1276 1444 wscript.exe wscript.exe PID 1444 wrote to memory of 1276 1444 wscript.exe wscript.exe PID 3964 wrote to memory of 4764 3964 wscript.exe AsyncClient.exe PID 3964 wrote to memory of 4764 3964 wscript.exe AsyncClient.exe PID 3964 wrote to memory of 4764 3964 wscript.exe AsyncClient.exe PID 4764 wrote to memory of 2644 4764 AsyncClient.exe cmd.exe PID 4764 wrote to memory of 2644 4764 AsyncClient.exe cmd.exe PID 4764 wrote to memory of 2644 4764 AsyncClient.exe cmd.exe PID 4764 wrote to memory of 4308 4764 AsyncClient.exe cmd.exe PID 4764 wrote to memory of 4308 4764 AsyncClient.exe cmd.exe PID 4764 wrote to memory of 4308 4764 AsyncClient.exe cmd.exe PID 4308 wrote to memory of 4296 4308 cmd.exe timeout.exe PID 4308 wrote to memory of 4296 4308 cmd.exe timeout.exe PID 4308 wrote to memory of 4296 4308 cmd.exe timeout.exe PID 2644 wrote to memory of 4120 2644 cmd.exe schtasks.exe PID 2644 wrote to memory of 4120 2644 cmd.exe schtasks.exe PID 2644 wrote to memory of 4120 2644 cmd.exe schtasks.exe PID 4308 wrote to memory of 2520 4308 cmd.exe win.exe PID 4308 wrote to memory of 2520 4308 cmd.exe win.exe PID 4308 wrote to memory of 2520 4308 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-PO#20222906.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB46B.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RFQ-PO#20222906.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB46B.tmp.batFilesize
147B
MD5fefc9f69d97eb3d7d886ca7a192bf4a8
SHA19ef9f1efd00d9c2e09d6733344f8aa13e78f4572
SHA25687bcc95d6ecfcbb6d1dc9ef7fea41d5f45460d88112a94020476ce91ec177fd6
SHA512b2bbd1d287d6f6c48e9afd7b22dacf1937f1ecf9b5efc475357be89fc3e26e248085292d1e25d561d354422632a8dad09dd9608da5febbe3816a0f8a754aa647
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ-PO#20222906.jsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\RFQ-PO#20222906.jsFilesize
197KB
MD5558ced74df141e2e8f4a340edccd5e16
SHA109e29290df81916a3621bcde3c467b1af2228a24
SHA256b090d245e1cc85444c011b6b6c9c73dfa85f8e1ff5f3449d2e807552c7db6f7d
SHA5129ffc284caf3c745831b38445cfed7c664559bfb0f86348c844fc0ab4542180c7389efe61c3f0f9aeb7dbe398f7a8b147d9d0e69b3da3d9d080fea35458d4f3be
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/1276-134-0x0000000000000000-mapping.dmp
-
memory/1444-132-0x0000000000000000-mapping.dmp
-
memory/2520-147-0x0000000000000000-mapping.dmp
-
memory/2644-142-0x0000000000000000-mapping.dmp
-
memory/3964-130-0x0000000000000000-mapping.dmp
-
memory/4120-146-0x0000000000000000-mapping.dmp
-
memory/4296-145-0x0000000000000000-mapping.dmp
-
memory/4308-143-0x0000000000000000-mapping.dmp
-
memory/4764-141-0x0000000004C70000-0x0000000004D0C000-memory.dmpFilesize
624KB
-
memory/4764-140-0x00000000001E0000-0x00000000001F2000-memory.dmpFilesize
72KB
-
memory/4764-137-0x0000000000000000-mapping.dmp