Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 04:11
Static task
static1
Behavioral task
behavioral1
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win10v2004-20220414-en
General
-
Target
558ced74df141e2e8f4a340edccd5e16.js
-
Size
197KB
-
MD5
308d7ff7f284eed50cb29aedc8f3bb48
-
SHA1
3cf054753beb7c857c198b5def3804e29f3426ff
-
SHA256
380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
-
SHA512
c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral2/memory/2200-140-0x0000000000680000-0x0000000000692000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat -
Blocklisted process makes network request 5 IoCs
Processes:
wscript.exeflow pid process 17 1656 wscript.exe 34 1656 wscript.exe 51 1656 wscript.exe 66 1656 wscript.exe 74 1656 wscript.exe -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 2200 AsyncClient.exe 3852 win.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exewscript.exewscript.exeAsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\558ced74df141e2e8f4a340edccd5e16 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\558ced74df141e2e8f4a340edccd5e16.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4076 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
AsyncClient.exepid process 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe 2200 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 2200 AsyncClient.exe Token: SeDebugPrivilege 3852 win.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
wscript.exewscript.exewscript.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 3764 wrote to memory of 3432 3764 wscript.exe wscript.exe PID 3764 wrote to memory of 3432 3764 wscript.exe wscript.exe PID 3764 wrote to memory of 1656 3764 wscript.exe wscript.exe PID 3764 wrote to memory of 1656 3764 wscript.exe wscript.exe PID 3432 wrote to memory of 2200 3432 wscript.exe AsyncClient.exe PID 3432 wrote to memory of 2200 3432 wscript.exe AsyncClient.exe PID 3432 wrote to memory of 2200 3432 wscript.exe AsyncClient.exe PID 1656 wrote to memory of 2516 1656 wscript.exe wscript.exe PID 1656 wrote to memory of 2516 1656 wscript.exe wscript.exe PID 2200 wrote to memory of 4512 2200 AsyncClient.exe cmd.exe PID 2200 wrote to memory of 4512 2200 AsyncClient.exe cmd.exe PID 2200 wrote to memory of 4512 2200 AsyncClient.exe cmd.exe PID 2200 wrote to memory of 5092 2200 AsyncClient.exe cmd.exe PID 2200 wrote to memory of 5092 2200 AsyncClient.exe cmd.exe PID 2200 wrote to memory of 5092 2200 AsyncClient.exe cmd.exe PID 4512 wrote to memory of 4528 4512 cmd.exe schtasks.exe PID 4512 wrote to memory of 4528 4512 cmd.exe schtasks.exe PID 4512 wrote to memory of 4528 4512 cmd.exe schtasks.exe PID 5092 wrote to memory of 4076 5092 cmd.exe timeout.exe PID 5092 wrote to memory of 4076 5092 cmd.exe timeout.exe PID 5092 wrote to memory of 4076 5092 cmd.exe timeout.exe PID 5092 wrote to memory of 3852 5092 cmd.exe win.exe PID 5092 wrote to memory of 3852 5092 cmd.exe win.exe PID 5092 wrote to memory of 3852 5092 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\558ced74df141e2e8f4a340edccd5e16.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp35A6.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\558ced74df141e2e8f4a340edccd5e16.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WpkCGRDGea.js"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp35A6.tmp.batFilesize
147B
MD51b728f835d904b9917a6c754ae15f1c4
SHA16aad116f42174e2848b57d50228e4afbe8cc674b
SHA25621470733c37c7946af1b279af65e8c09c8e1abd74d523af9267f9e357201ed0b
SHA512917bee37c6e67f8bc307b43f38efe0c7b55943b1e39cd79fc81d641fddafd409994df885f5b444283dcdc37807ec9597589d17cfccc4163ff506668260f39c5c
-
C:\Users\Admin\AppData\Roaming\558ced74df141e2e8f4a340edccd5e16.jsFilesize
197KB
MD5308d7ff7f284eed50cb29aedc8f3bb48
SHA13cf054753beb7c857c198b5def3804e29f3426ff
SHA256380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
SHA512c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\558ced74df141e2e8f4a340edccd5e16.jsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\WpkCGRDGea.jsFilesize
90KB
MD518024bce1779bd2a699774f49a7ccb9e
SHA171d98c4b2509d40ebd128817051f8ca0271f3710
SHA25616240be574ce82b98e9484ff2e2fcbe087f62da6f2b35eb38a67df109ee2803c
SHA512d92c8e3b8e5b6225bd8a0f94a445fef52d012c20feccee8d4c7f3591ce6a806f83050a95780862f1acb6b18ba41a766043f9f7d1397bec0660043bb5d05696c3
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/1656-132-0x0000000000000000-mapping.dmp
-
memory/2200-140-0x0000000000680000-0x0000000000692000-memory.dmpFilesize
72KB
-
memory/2200-141-0x0000000002D50000-0x0000000002DEC000-memory.dmpFilesize
624KB
-
memory/2200-134-0x0000000000000000-mapping.dmp
-
memory/2516-136-0x0000000000000000-mapping.dmp
-
memory/3432-130-0x0000000000000000-mapping.dmp
-
memory/3852-147-0x0000000000000000-mapping.dmp
-
memory/4076-146-0x0000000000000000-mapping.dmp
-
memory/4512-142-0x0000000000000000-mapping.dmp
-
memory/4528-145-0x0000000000000000-mapping.dmp
-
memory/5092-143-0x0000000000000000-mapping.dmp