Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2023 09:07

General

  • Target

    MV BMC ENDORA V0123- PDA.js

  • Size

    128KB

  • MD5

    3a084e6817bf9b361b8ff6618d767c09

  • SHA1

    f27662987fd14d69523efec560e29c1d66a2a645

  • SHA256

    cee54813009042b01b4ebd1afbf99160b0c25465b7530332ba5bb064be6eba63

  • SHA512

    a49b1732ea52aff5cdf57b10ef8c46c5185805ed13a6d032b5cc0aa326a4101aa6744ac12732ed5f8c87e9ad39d8b7da8b31a4c2208eb79c97db6c9e94b0fd11

  • SSDEEP

    3072:ool0yHnHmo2BPDf/DUGOxxVZh/O5kaUH02x2RVy:ogHmouPDf/DnYhmhPRVy

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

84.21.172.33:6606

84.21.172.33:7707

84.21.172.33:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Recycle Bin.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Async RAT payload 7 IoCs
  • Blocklisted process makes network request 16 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\MV BMC ENDORA V0123- PDA.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FtFYVjAgTz.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:556
    • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
      "C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Recycle Bin" /tr '"C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Recycle Bin" /tr '"C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:864
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1DFD.tmp.bat""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:1092
        • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe
          "C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1432

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Local\Temp\tmp1DFD.tmp.bat

    Filesize

    155B

    MD5

    b082887b65398b485f4d092b71bc92e2

    SHA1

    21755648ebd2f9acb7319285e281fb7dc52907ad

    SHA256

    266ba56cca74e30d895cbb31b9266697a5af8d8c909f583e72a9d9649ad779c2

    SHA512

    c04bfe2a550b3fecdb45d224f456a92c218f69914e80c0a5c465338482802bd19c4751e601dd59561f956eaa9834af8d9558a930ecb1366b190b12113dc4588b

  • C:\Users\Admin\AppData\Roaming\FtFYVjAgTz.js

    Filesize

    16KB

    MD5

    7586d9e4467d26fde97538eab36cf88c

    SHA1

    d7fcd37e0bc9e790023a38d2d470cd001f81ca92

    SHA256

    7aff4cbd997ad6886484076ba71d1c067931d9a1462aa16e9d2fc47b4d5b8f18

    SHA512

    02676bd1e1086eeae9bdec3bce065ac97267c457daf6fbd77a783d7fc81fc6f891518d6fd19dd525e84ebd25e3098614c4bbefa71ded301cd3a7a46ed2a40e0a

  • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • \Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • memory/316-64-0x0000000000000000-mapping.dmp

  • memory/556-55-0x0000000000000000-mapping.dmp

  • memory/764-57-0x0000000000000000-mapping.dmp

  • memory/764-62-0x0000000075491000-0x0000000075493000-memory.dmp

    Filesize

    8KB

  • memory/764-61-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

    Filesize

    72KB

  • memory/864-65-0x0000000000000000-mapping.dmp

  • memory/1092-67-0x0000000000000000-mapping.dmp

  • memory/1336-54-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmp

    Filesize

    8KB

  • memory/1432-70-0x0000000000000000-mapping.dmp

  • memory/1432-72-0x0000000000CF0000-0x0000000000D02000-memory.dmp

    Filesize

    72KB

  • memory/1888-63-0x0000000000000000-mapping.dmp