asyncrat | 58e9508e363895165bee8892c9fde2c1048d2e000c44fd4bc2be739a37adfb92

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2023, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm V3.1 - Copy/XWorm HVNC.exe
Size

50KB
MD5

e11b0d5c1b597b014dfc2aeccb8eaf9e
SHA1

c13e391e72374817061d3e27a4fbbb6d26e485f1
SHA256

8b66826cc7573458e6993f1aee53f02f47be5ccbd8e97212c921f06c275acef3
SHA512

b64f583bc0fbbd0ec0db25c0150f1a90a4743cdf15277129f4a3fefc910d431a4dfb5467f5791f66c4fe2acc528326d3e1d930ba8779cbde9673d4191817aa05
SSDEEP

1536:s1fBubRKi+LHF99AFU6sOuGUdS1EAd8II0:siKi+LHF99AYOuJgEA6II0

Score

10^/10

asyncrat xenarmor password persistence rat recovery

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	XWorm HVNC.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWorm HVNC.lnk	XWorm HVNC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWorm HVNC.lnk	XWorm HVNC.exe

Executes dropped EXE 1 IoCs

pid	Process
2476	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XWorm HVNC = "C:\\Users\\Public\\XWorm HVNC.exe"	XWorm HVNC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
2316	powershell.exe
2316	powershell.exe
5040	powershell.exe
5040	powershell.exe
4952	XWorm HVNC.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	XWorm HVNC.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4952	XWorm HVNC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4952	XWorm HVNC.exe
2476	All-In-One.exe
2476	All-In-One.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4844	4952	XWorm HVNC.exe	79
PID 4952 wrote to memory of 4844	4952	XWorm HVNC.exe	79
PID 4952 wrote to memory of 2316	4952	XWorm HVNC.exe	81
PID 4952 wrote to memory of 2316	4952	XWorm HVNC.exe	81
PID 4952 wrote to memory of 5040	4952	XWorm HVNC.exe	83
PID 4952 wrote to memory of 5040	4952	XWorm HVNC.exe	83
PID 4952 wrote to memory of 5108	4952	XWorm HVNC.exe	92
PID 4952 wrote to memory of 5108	4952	XWorm HVNC.exe	92
PID 5108 wrote to memory of 2476	5108	cmd.exe	94
PID 5108 wrote to memory of 2476	5108	cmd.exe	94
PID 5108 wrote to memory of 2476	5108	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 - Copy\XWorm HVNC.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 - Copy\XWorm HVNC.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 - Copy\XWorm HVNC.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm HVNC.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\XWorm HVNC.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
    All-In-One.exe OutPut.json
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c1b0a9f26c3e1786191e94e419f1fbf9

SHA1
7f3492f4ec2d93e164f43fe2606b53edcffd8926

SHA256
796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

SHA512
fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\All-In-One.exe

Filesize
5.1MB

MD5
a48e3197ab0f64c4684f0828f742165c

SHA1
f935c3d6f9601c795f2211e34b3778fad14442b4

SHA256
baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb

SHA512
e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59

Download Submit
memory/2316-141-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download
memory/4844-136-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download
memory/4844-137-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download
memory/4844-135-0x00000207BE340000-0x00000207BE362000-memory.dmp

Filesize
136KB

Download
memory/4952-132-0x00000000007E0000-0x00000000007F2000-memory.dmp

Filesize
72KB

Download
memory/4952-145-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download
memory/4952-133-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download
memory/5040-144-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmp

Filesize
10.8MB

Download