Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 02:00

General

  • Target

    service.exe

  • Size

    283KB

  • MD5

    cc9cbbfa9ccc9cefe75253c65ad22405

  • SHA1

    f126e2c4431a9eacab858316eaf031fb5e7bc9f1

  • SHA256

    4d19771fb289f892626b1b04c120f53d69492ec87df2bfd6809dd6fce8662c3c

  • SHA512

    bbc779e3daf6d9dcf249ba59d99feb34a62fe7f381d74b608fcc8719806eef88a04491983623417c9560f2dfc4858f6e8ec12362cf93e57ca3a78e1984ba2e17

  • SSDEEP

    6144:7gZiAEAO0sByNsAal3gVAWgS7/OhwjKfqZK:7gZXEAO/BUdG3gVdt7KnfqZK

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://pastebin.com/raw/vNcCt60A

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    10

  • install

    true

  • install_file

    csrss.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/3Z9zi18j

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 6 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\service.exe
    "C:\Users\Admin\AppData\Local\Temp\service.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -nologo -command .\service.ps1
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\SysWOW64\attrib.exe
          "C:\Windows\system32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:4456
        • C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Users\Admin\AppData\Local\Temp\csrss.exe
            "C:\Users\Admin\AppData\Local\Temp\csrss.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3464
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"' & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"'
                7⤵
                • Creates scheduled task(s)
                PID:3560
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE479.tmp.bat""
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4780
              • C:\Windows\system32\timeout.exe
                timeout 3
                7⤵
                • Delays execution with timeout.exe
                PID:4440
              • C:\Users\Admin\AppData\Roaming\csrss.exe
                "C:\Users\Admin\AppData\Roaming\csrss.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5108
          • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
            "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2768

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

          Filesize

          425B

          MD5

          fff5cbccb6b31b40f834b8f4778a779a

          SHA1

          899ed0377e89f1ed434cfeecc5bc0163ebdf0454

          SHA256

          b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

          SHA512

          1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

          Filesize

          1.9MB

          MD5

          ec801a7d4b72a288ec6c207bb9ff0131

          SHA1

          32eec2ae1f9e201516fa7fcdc16c4928f7997561

          SHA256

          b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

          SHA512

          a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

          Filesize

          1.9MB

          MD5

          ec801a7d4b72a288ec6c207bb9ff0131

          SHA1

          32eec2ae1f9e201516fa7fcdc16c4928f7997561

          SHA256

          b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

          SHA512

          a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

        • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

          Filesize

          1.9MB

          MD5

          ec801a7d4b72a288ec6c207bb9ff0131

          SHA1

          32eec2ae1f9e201516fa7fcdc16c4928f7997561

          SHA256

          b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

          SHA512

          a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs

          Filesize

          147B

          MD5

          e04e55d2e6cc3d920631fdc5d6dcc1ce

          SHA1

          2c4dbcff71f8678623a7c197440ec281804dc5a5

          SHA256

          f641a99ec7e549970c81d724766f2a60ff031a5ec92aa6fc84228c82eeb4b4eb

          SHA512

          9511fe4dc599187f4539b8cda476550c54e86cbfcaca339a5db12e980ec322bf488d7458bf76089aa1d845f164f7ddb8adea017923d9a4930b9e821b7a4ae998

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\service.ps1

          Filesize

          797B

          MD5

          eb9c76ab230c2b8527d504429d7aca20

          SHA1

          ca4fc2fcb5023fa8398fc5a0c15e7ad23a61e8cb

          SHA256

          f985277690d6c85a064bc5d494d20d0774fb5017eaf7874685378c538bd49dbf

          SHA512

          f791797d8301242f2334767153ae7133193cee75538ce38b9d5fa5b60388428a8808c22eb08dd070f6f7e3ce556cf1f04883285eaa44ddf8aba1bd67886429c2

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyvsq00u.vpv.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\csrss.exe

          Filesize

          63KB

          MD5

          4e8ed7a82d6919108934eaa3fcd3ed9f

          SHA1

          f74a1c9fc02c8374ec0ee68438ae309f1f61ff41

          SHA256

          c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364

          SHA512

          2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

        • C:\Users\Admin\AppData\Local\Temp\csrss.exe

          Filesize

          63KB

          MD5

          4e8ed7a82d6919108934eaa3fcd3ed9f

          SHA1

          f74a1c9fc02c8374ec0ee68438ae309f1f61ff41

          SHA256

          c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364

          SHA512

          2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

        • C:\Users\Admin\AppData\Local\Temp\csrss.exe

          Filesize

          63KB

          MD5

          4e8ed7a82d6919108934eaa3fcd3ed9f

          SHA1

          f74a1c9fc02c8374ec0ee68438ae309f1f61ff41

          SHA256

          c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364

          SHA512

          2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

        • C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

          Filesize

          2.3MB

          MD5

          83a24ea1847f5cbb5508785abb5126ea

          SHA1

          63930e7171d1fc94fd4ec745392b3a1136cb0496

          SHA256

          246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268

          SHA512

          fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e

        • C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

          Filesize

          2.3MB

          MD5

          83a24ea1847f5cbb5508785abb5126ea

          SHA1

          63930e7171d1fc94fd4ec745392b3a1136cb0496

          SHA256

          246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268

          SHA512

          fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e

        • C:\Users\Admin\AppData\Local\Temp\tmpE479.tmp.bat

          Filesize

          149B

          MD5

          b72a4ad50c4c34797a4dd18d888ab0eb

          SHA1

          de0c2af2871c59edc145b23f3154623c7be36e72

          SHA256

          414f31ba089ad5fc2a71d549d284fdc005a13b789dcc72d2d25b09ca9118bb53

          SHA512

          ea271d70752e86b70aa933a1c00253593eaf0b686415c894462390fb9364969f0719290f97fa3d5d02651cda5b15f7999a88c0b16ef54984535db21fd48100ea

        • C:\Users\Admin\AppData\Roaming\csrss.exe

          Filesize

          63KB

          MD5

          4e8ed7a82d6919108934eaa3fcd3ed9f

          SHA1

          f74a1c9fc02c8374ec0ee68438ae309f1f61ff41

          SHA256

          c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364

          SHA512

          2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

        • C:\Users\Admin\AppData\Roaming\csrss.exe

          Filesize

          63KB

          MD5

          4e8ed7a82d6919108934eaa3fcd3ed9f

          SHA1

          f74a1c9fc02c8374ec0ee68438ae309f1f61ff41

          SHA256

          c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364

          SHA512

          2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

        • memory/1228-160-0x00000000065C0000-0x00000000065DA000-memory.dmp

          Filesize

          104KB

        • memory/1228-158-0x0000000007070000-0x0000000007106000-memory.dmp

          Filesize

          600KB

        • memory/1228-164-0x00000000073C0000-0x00000000073F2000-memory.dmp

          Filesize

          200KB

        • memory/1228-165-0x000000006F490000-0x000000006F4DC000-memory.dmp

          Filesize

          304KB

        • memory/1228-175-0x00000000080D0000-0x00000000080EE000-memory.dmp

          Filesize

          120KB

        • memory/1228-176-0x0000000008200000-0x000000000820A000-memory.dmp

          Filesize

          40KB

        • memory/1228-177-0x000000007F030000-0x000000007F040000-memory.dmp

          Filesize

          64KB

        • memory/1228-178-0x00000000082C0000-0x00000000082CE000-memory.dmp

          Filesize

          56KB

        • memory/1228-179-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/1228-180-0x0000000008310000-0x000000000832A000-memory.dmp

          Filesize

          104KB

        • memory/1228-181-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/1228-182-0x0000000008300000-0x0000000008308000-memory.dmp

          Filesize

          32KB

        • memory/1228-183-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/1228-162-0x0000000007710000-0x0000000007CB4000-memory.dmp

          Filesize

          5.6MB

        • memory/1228-159-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/1228-140-0x0000000002790000-0x00000000027C6000-memory.dmp

          Filesize

          216KB

        • memory/1228-161-0x0000000006610000-0x0000000006632000-memory.dmp

          Filesize

          136KB

        • memory/1228-163-0x0000000008340000-0x00000000089BA000-memory.dmp

          Filesize

          6.5MB

        • memory/1228-156-0x0000000006090000-0x00000000060AE000-memory.dmp

          Filesize

          120KB

        • memory/1228-141-0x00000000051C0000-0x00000000057E8000-memory.dmp

          Filesize

          6.2MB

        • memory/1228-146-0x0000000005A50000-0x0000000005AB6000-memory.dmp

          Filesize

          408KB

        • memory/1228-145-0x00000000059E0000-0x0000000005A46000-memory.dmp

          Filesize

          408KB

        • memory/1228-144-0x00000000050E0000-0x0000000005102000-memory.dmp

          Filesize

          136KB

        • memory/1228-142-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/1228-143-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/2768-330-0x000000001F350000-0x000000001F362000-memory.dmp

          Filesize

          72KB

        • memory/2768-331-0x000000001F3B0000-0x000000001F3EC000-memory.dmp

          Filesize

          240KB

        • memory/2768-333-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/2768-334-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/2768-329-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/2768-340-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/2768-341-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/2768-328-0x00000000007C0000-0x00000000009A6000-memory.dmp

          Filesize

          1.9MB

        • memory/2768-346-0x000000001CB70000-0x000000001CB80000-memory.dmp

          Filesize

          64KB

        • memory/3464-269-0x0000000000C20000-0x0000000000C36000-memory.dmp

          Filesize

          88KB

        • memory/4432-189-0x0000000000400000-0x000000000064E000-memory.dmp

          Filesize

          2.3MB