Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2022 08:03

General

  • Target

    InvoicePrinting-MUM02322_22-23.js

  • Size

    244KB

  • MD5

    0afa9ad6977e7cfed21f642361e9bcef

  • SHA1

    61301fd144aac65ab7fdc847e7ef3cb5c339dcd1

  • SHA256

    7cdb69e4725d8cd97ba8e9b8d9e072e71cb3b796951dd6e4a0c92dea771a5686

  • SHA512

    c6acddf460b3eda7aed7fed654120d94899f76e382df3a96c007029e7653cbacd6e5efecc20ff25e1b5a2099f1494936c2f704a53bf278d65cb2f680f2bce438

  • SSDEEP

    6144:Gp8xbeXigeXfd1LH3dV6zMovRCBeGKWAklgF2GuuZmDuh5wTaR:42d1Lj65vfGKel029lDufwTo

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

172.93.220.135:6606

172.93.220.135:7707

172.93.220.135:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    shh.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 7 IoCs
  • Blocklisted process makes network request 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\InvoicePrinting-MUM02322_22-23.js
    1⤵
    • Blocklisted process makes network request
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\err.exe
      "C:\Users\Admin\AppData\Local\Temp\err.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:1984
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp235A.tmp.bat""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:2040
        • C:\Users\Admin\AppData\Roaming\shh.exe
          "C:\Users\Admin\AppData\Roaming\shh.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\err.exe

    Filesize

    45KB

    MD5

    a1e6c547b3d494b82c0aec8e08cb444e

    SHA1

    7b851492a93cd9ebb9ceb88a77ee48634c0e82e7

    SHA256

    a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51

    SHA512

    e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

  • C:\Users\Admin\AppData\Local\Temp\err.exe

    Filesize

    45KB

    MD5

    a1e6c547b3d494b82c0aec8e08cb444e

    SHA1

    7b851492a93cd9ebb9ceb88a77ee48634c0e82e7

    SHA256

    a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51

    SHA512

    e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

  • C:\Users\Admin\AppData\Local\Temp\tmp235A.tmp.bat

    Filesize

    147B

    MD5

    9fb9f70497a02f248f013ac78b5c1144

    SHA1

    4d6360a627d12ca9ff588437a48d9d2f6ba93679

    SHA256

    93c86b02e823cca2e0a6cf07f98418551072dc67c4eaef7dc1e34e8a3c03a506

    SHA512

    b1f5823543e8a36f9db3eedf5d86f5fe4c43cb040c1103e89bd34212d85f466a4968fe0e4df4f66452d2319bfa3dc647c9b7f6a4b162584b926af78efd27c1a2

  • C:\Users\Admin\AppData\Roaming\shh.exe

    Filesize

    45KB

    MD5

    a1e6c547b3d494b82c0aec8e08cb444e

    SHA1

    7b851492a93cd9ebb9ceb88a77ee48634c0e82e7

    SHA256

    a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51

    SHA512

    e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

  • C:\Users\Admin\AppData\Roaming\shh.exe

    Filesize

    45KB

    MD5

    a1e6c547b3d494b82c0aec8e08cb444e

    SHA1

    7b851492a93cd9ebb9ceb88a77ee48634c0e82e7

    SHA256

    a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51

    SHA512

    e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

  • \Users\Admin\AppData\Roaming\shh.exe

    Filesize

    45KB

    MD5

    a1e6c547b3d494b82c0aec8e08cb444e

    SHA1

    7b851492a93cd9ebb9ceb88a77ee48634c0e82e7

    SHA256

    a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51

    SHA512

    e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

  • memory/716-58-0x0000000000E50000-0x0000000000E62000-memory.dmp

    Filesize

    72KB

  • memory/716-59-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

    Filesize

    8KB

  • memory/1064-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

    Filesize

    8KB

  • memory/1184-69-0x0000000001090000-0x00000000010A2000-memory.dmp

    Filesize

    72KB