Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 04:11
Static task
static1
Behavioral task
behavioral1
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win10v2004-20220414-en
General
-
Target
558ced74df141e2e8f4a340edccd5e16.js
-
Size
197KB
-
MD5
308d7ff7f284eed50cb29aedc8f3bb48
-
SHA1
3cf054753beb7c857c198b5def3804e29f3426ff
-
SHA256
380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
-
SHA512
c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral1/memory/240-68-0x0000000001340000-0x0000000001352000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat behavioral1/memory/888-79-0x0000000000FD0000-0x0000000000FE2000-memory.dmp asyncrat -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 4 1272 wscript.exe 9 1272 wscript.exe 12 1272 wscript.exe 15 1272 wscript.exe 18 1272 wscript.exe 20 1272 wscript.exe -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 240 AsyncClient.exe 888 win.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.js wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 568 cmd.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 860 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 240 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 240 AsyncClient.exe Token: SeDebugPrivilege 888 win.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
wscript.exewscript.exewscript.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 1672 wrote to memory of 988 1672 wscript.exe wscript.exe PID 1672 wrote to memory of 988 1672 wscript.exe wscript.exe PID 1672 wrote to memory of 988 1672 wscript.exe wscript.exe PID 1672 wrote to memory of 1272 1672 wscript.exe wscript.exe PID 1672 wrote to memory of 1272 1672 wscript.exe wscript.exe PID 1672 wrote to memory of 1272 1672 wscript.exe wscript.exe PID 988 wrote to memory of 240 988 wscript.exe AsyncClient.exe PID 988 wrote to memory of 240 988 wscript.exe AsyncClient.exe PID 988 wrote to memory of 240 988 wscript.exe AsyncClient.exe PID 988 wrote to memory of 240 988 wscript.exe AsyncClient.exe PID 1272 wrote to memory of 468 1272 wscript.exe wscript.exe PID 1272 wrote to memory of 468 1272 wscript.exe wscript.exe PID 1272 wrote to memory of 468 1272 wscript.exe wscript.exe PID 240 wrote to memory of 1464 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 1464 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 1464 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 1464 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 568 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 568 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 568 240 AsyncClient.exe cmd.exe PID 240 wrote to memory of 568 240 AsyncClient.exe cmd.exe PID 1464 wrote to memory of 1760 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1760 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1760 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1760 1464 cmd.exe schtasks.exe PID 568 wrote to memory of 860 568 cmd.exe timeout.exe PID 568 wrote to memory of 860 568 cmd.exe timeout.exe PID 568 wrote to memory of 860 568 cmd.exe timeout.exe PID 568 wrote to memory of 860 568 cmd.exe timeout.exe PID 568 wrote to memory of 888 568 cmd.exe win.exe PID 568 wrote to memory of 888 568 cmd.exe win.exe PID 568 wrote to memory of 888 568 cmd.exe win.exe PID 568 wrote to memory of 888 568 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\558ced74df141e2e8f4a340edccd5e16.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp278E.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\558ced74df141e2e8f4a340edccd5e16.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp278E.tmp.batFilesize
147B
MD586b17efb63022d6cff45d9269eceed22
SHA198c313dc7178d9e30e5af96cbc89a1f4af338b5a
SHA25680aec571478ad1d2040eb9bb38225f52997a331ce91edeaf5cdd318232babced
SHA512d35204215bed3180f66eea7a7fd7cea7f642ac3ac725a7509ba3b754f77b8621a6ab1e859b4d2923815abacdde4a014a41a05109e031866313042601fef4af3b
-
C:\Users\Admin\AppData\Roaming\558ced74df141e2e8f4a340edccd5e16.jsFilesize
197KB
MD5308d7ff7f284eed50cb29aedc8f3bb48
SHA13cf054753beb7c857c198b5def3804e29f3426ff
SHA256380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
SHA512c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.jsFilesize
197KB
MD5308d7ff7f284eed50cb29aedc8f3bb48
SHA13cf054753beb7c857c198b5def3804e29f3426ff
SHA256380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
SHA512c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/240-68-0x0000000001340000-0x0000000001352000-memory.dmpFilesize
72KB
-
memory/240-61-0x0000000000000000-mapping.dmp
-
memory/240-69-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/468-64-0x0000000000000000-mapping.dmp
-
memory/568-71-0x0000000000000000-mapping.dmp
-
memory/860-74-0x0000000000000000-mapping.dmp
-
memory/888-77-0x0000000000000000-mapping.dmp
-
memory/888-79-0x0000000000FD0000-0x0000000000FE2000-memory.dmpFilesize
72KB
-
memory/988-55-0x0000000000000000-mapping.dmp
-
memory/1272-56-0x0000000000000000-mapping.dmp
-
memory/1464-70-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmpFilesize
8KB
-
memory/1760-73-0x0000000000000000-mapping.dmp