Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2023, 06:22

General

  • Target

    service.exe

  • Size

    237KB

  • MD5

    ab439c03eb89bc15757588b7b030bea6

  • SHA1

    50411b04ba6c51aab0f706e3a54fc548b5f8df0f

  • SHA256

    be067c2c7c5a474442339d8adc999a0a288d56890d9781e88f536b6183cd398c

  • SHA512

    7784fb618db8f2951bd8032154da86c9f139d51a4e541c9924cfccab99862efbcf92b8cbd582714e5f243d2cd5ee1b9fa2bb076f7d9b683e4b57e7b9e347c9a7

  • SSDEEP

    3072:r4tWK9YMDbz6fV/NpbnyAGJwhOnQdT1MgvAOdj8MXoiTYfSHw69pJZXAqacHy1ly:m9j76xnImFZ1MmF8QTU/urSiLfTP8U

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://pastebin.com/raw/vNcCt60A

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

Mutex

Mutex

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/s14cUU5G

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\service.exe
    "C:\Users\Admin\AppData\Local\Temp\service.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -nologo -command .\service.ps1
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\SysWOW64\attrib.exe
          "C:\Windows\System32\attrib.exe" +s +h .\\tmp1DD4.exe
          4⤵
          • Sets file to hidden
          • Drops startup file
          • Views/modifies file attributes
          PID:4512
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1DD4.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1DD4.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5032

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs

          Filesize

          147B

          MD5

          e04e55d2e6cc3d920631fdc5d6dcc1ce

          SHA1

          2c4dbcff71f8678623a7c197440ec281804dc5a5

          SHA256

          f641a99ec7e549970c81d724766f2a60ff031a5ec92aa6fc84228c82eeb4b4eb

          SHA512

          9511fe4dc599187f4539b8cda476550c54e86cbfcaca339a5db12e980ec322bf488d7458bf76089aa1d845f164f7ddb8adea017923d9a4930b9e821b7a4ae998

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\service.ps1

          Filesize

          949B

          MD5

          8a97b217587bf21df5b6be29428a1251

          SHA1

          33bc1ad54acc40f29d1b09767811c4a9f779f9a5

          SHA256

          ac975c8129b58f138e0f9880d5d63e6ca9e350c875e09a6dd5c16b40eaa9ea0d

          SHA512

          944c4fbbb3e92afad4cb4fc9f675cbe0b12ff3ef371fa1a5acdffb8489d7c7dde6e2cb8c2a1e194db9eba8e7c74db82b91ceaa40bc3f189924adaeae01cc2409

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eugyxmb2.z0t.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1DD4.exe

          Filesize

          48KB

          MD5

          fa378b2bb6985eec44142dca9f381985

          SHA1

          5b6614fcfc131772ab7d8e9df13b84a9c8b8aec0

          SHA256

          07280cbf4815aba1b1841d4eeb86df01483c240301006c4f1d566e152e1ad783

          SHA512

          117dbd8efaedec137667fd6cd64db0ad2d1396118aeb29fcbf2e7876c4f68d085ccfe5526f586aedbd5e22d4f4e986ff1660b182e6f375d46cd900efe57cc0fa

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1DD4.exe

          Filesize

          48KB

          MD5

          fa378b2bb6985eec44142dca9f381985

          SHA1

          5b6614fcfc131772ab7d8e9df13b84a9c8b8aec0

          SHA256

          07280cbf4815aba1b1841d4eeb86df01483c240301006c4f1d566e152e1ad783

          SHA512

          117dbd8efaedec137667fd6cd64db0ad2d1396118aeb29fcbf2e7876c4f68d085ccfe5526f586aedbd5e22d4f4e986ff1660b182e6f375d46cd900efe57cc0fa

        • memory/3852-163-0x0000000008170000-0x00000000087EA000-memory.dmp

          Filesize

          6.5MB

        • memory/3852-165-0x000000006F2C0000-0x000000006F30C000-memory.dmp

          Filesize

          304KB

        • memory/3852-150-0x0000000005870000-0x00000000058D6000-memory.dmp

          Filesize

          408KB

        • memory/3852-155-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/3852-156-0x0000000005F40000-0x0000000005F5E000-memory.dmp

          Filesize

          120KB

        • memory/3852-143-0x0000000004F00000-0x0000000004F22000-memory.dmp

          Filesize

          136KB

        • memory/3852-158-0x0000000006EF0000-0x0000000006F86000-memory.dmp

          Filesize

          600KB

        • memory/3852-159-0x0000000006490000-0x00000000064AA000-memory.dmp

          Filesize

          104KB

        • memory/3852-160-0x00000000064E0000-0x0000000006502000-memory.dmp

          Filesize

          136KB

        • memory/3852-161-0x0000000007540000-0x0000000007AE4000-memory.dmp

          Filesize

          5.6MB

        • memory/3852-162-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/3852-142-0x0000000004F60000-0x0000000005588000-memory.dmp

          Filesize

          6.2MB

        • memory/3852-164-0x0000000007270000-0x00000000072A2000-memory.dmp

          Filesize

          200KB

        • memory/3852-144-0x0000000005800000-0x0000000005866000-memory.dmp

          Filesize

          408KB

        • memory/3852-175-0x0000000008000000-0x000000000801E000-memory.dmp

          Filesize

          120KB

        • memory/3852-176-0x0000000008120000-0x000000000812A000-memory.dmp

          Filesize

          40KB

        • memory/3852-177-0x000000007FDB0000-0x000000007FDC0000-memory.dmp

          Filesize

          64KB

        • memory/3852-178-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/3852-179-0x0000000008930000-0x000000000893E000-memory.dmp

          Filesize

          56KB

        • memory/3852-180-0x0000000008990000-0x00000000089AA000-memory.dmp

          Filesize

          104KB

        • memory/3852-181-0x0000000008980000-0x0000000008988000-memory.dmp

          Filesize

          32KB

        • memory/3852-182-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/3852-140-0x00000000048D0000-0x0000000004906000-memory.dmp

          Filesize

          216KB

        • memory/3852-185-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/3852-141-0x0000000004920000-0x0000000004930000-memory.dmp

          Filesize

          64KB

        • memory/5032-187-0x0000000000570000-0x0000000000582000-memory.dmp

          Filesize

          72KB

        • memory/5032-190-0x0000000004E80000-0x0000000004E90000-memory.dmp

          Filesize

          64KB

        • memory/5032-191-0x0000000004E80000-0x0000000004E90000-memory.dmp

          Filesize

          64KB