Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2023 08:57

General

  • Target

    MV BMC ENDORA V0123- PDA.js

  • Size

    128KB

  • MD5

    3a084e6817bf9b361b8ff6618d767c09

  • SHA1

    f27662987fd14d69523efec560e29c1d66a2a645

  • SHA256

    cee54813009042b01b4ebd1afbf99160b0c25465b7530332ba5bb064be6eba63

  • SHA512

    a49b1732ea52aff5cdf57b10ef8c46c5185805ed13a6d032b5cc0aa326a4101aa6744ac12732ed5f8c87e9ad39d8b7da8b31a4c2208eb79c97db6c9e94b0fd11

  • SSDEEP

    3072:ool0yHnHmo2BPDf/DUGOxxVZh/O5kaUH02x2RVy:ogHmouPDf/DnYhmhPRVy

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

84.21.172.33:6606

84.21.172.33:7707

84.21.172.33:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Recycle Bin.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Async RAT payload 7 IoCs
  • Blocklisted process makes network request 16 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\MV BMC ENDORA V0123- PDA.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FtFYVjAgTz.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:1756
    • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
      "C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Recycle Bin" /tr '"C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Recycle Bin" /tr '"C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:552
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5E18.tmp.bat""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:1620
        • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe
          "C:\Users\Admin\AppData\Roaming\Recycle Bin.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Local\Temp\tmp5E18.tmp.bat

    Filesize

    155B

    MD5

    283069a509dcbec665140fd9d1cb1125

    SHA1

    b8c7494ec6c7612cd09a0b80a5bee48e84f72dbd

    SHA256

    157ebfe2f54922b9e7dd683dd576ab8c832cc130ea0c6b90a09a45b95ec132a1

    SHA512

    5febd13491c244783d6cab407d642a16057d722402c352e172412403edd614c3fbfe1e7de72f37c2cb06e770a09c72bf9f2e71cdd7f882bc402a83d4f205cbf7

  • C:\Users\Admin\AppData\Roaming\FtFYVjAgTz.js

    Filesize

    16KB

    MD5

    7586d9e4467d26fde97538eab36cf88c

    SHA1

    d7fcd37e0bc9e790023a38d2d470cd001f81ca92

    SHA256

    7aff4cbd997ad6886484076ba71d1c067931d9a1462aa16e9d2fc47b4d5b8f18

    SHA512

    02676bd1e1086eeae9bdec3bce065ac97267c457daf6fbd77a783d7fc81fc6f891518d6fd19dd525e84ebd25e3098614c4bbefa71ded301cd3a7a46ed2a40e0a

  • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • C:\Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • \Users\Admin\AppData\Roaming\Recycle Bin.exe

    Filesize

    48KB

    MD5

    1b5be7647628e1de782bb8f33d369dd3

    SHA1

    cd6e2f240ea97d03c6c796ab3573f728d6c30d9f

    SHA256

    fb7bd4fd5348db2f3b763f5215e964892387af9fe83df18455432dc245f7b903

    SHA512

    93de4f650672705d3975ba7dd0d0901c03834117d014f91dc093ac0a26abed7737aa2344dd30bb8fd258220576d09ec15368777597d78bec9f43dfa53f67b155

  • memory/552-65-0x0000000000000000-mapping.dmp

  • memory/1620-67-0x0000000000000000-mapping.dmp

  • memory/1756-55-0x0000000000000000-mapping.dmp

  • memory/1816-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

    Filesize

    8KB

  • memory/1868-64-0x0000000000000000-mapping.dmp

  • memory/1880-75-0x00000000006E0000-0x00000000006EA000-memory.dmp

    Filesize

    40KB

  • memory/1880-77-0x0000000005A20000-0x0000000005A80000-memory.dmp

    Filesize

    384KB

  • memory/1880-76-0x0000000005C10000-0x0000000005CA0000-memory.dmp

    Filesize

    576KB

  • memory/1880-70-0x0000000000000000-mapping.dmp

  • memory/1880-72-0x00000000003B0000-0x00000000003C2000-memory.dmp

    Filesize

    72KB

  • memory/1880-74-0x0000000005330000-0x00000000053AE000-memory.dmp

    Filesize

    504KB

  • memory/1928-63-0x0000000000000000-mapping.dmp

  • memory/1956-62-0x00000000756A1000-0x00000000756A3000-memory.dmp

    Filesize

    8KB

  • memory/1956-57-0x0000000000000000-mapping.dmp

  • memory/1956-61-0x0000000000E30000-0x0000000000E42000-memory.dmp

    Filesize

    72KB