asyncrat | 9d10c657c92287be8ad1a1fa48ce11adbc4c0a1038bc62c289cb1bc55f617d78

Resubmissions

20/07/2023, 20:16

230720-y16m6sae43 10

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Mia_Khalifa_IMGS.vbs
Size

4.6MB
MD5

39704ede0422df1cb131a00a1cac00d2
SHA1

90ee4ef8e4b8dcf175537f386b5cda1ebe355163
SHA256

9d10c657c92287be8ad1a1fa48ce11adbc4c0a1038bc62c289cb1bc55f617d78
SHA512

5ee467f39a8494a975f702329486f54a66dad7b81a3adb43d6ca9c5a1c308320c5e6b8dda52021c1ed9bf971f63c3cc8d12eca47a53d25608577f84063f9b01c
SSDEEP

6144:xyyyyyyyyyFyyyyyyyyFyyyyyyyyFyyyyyyyyyyyyyyyyyyyFFFyyyyyyyyyyy4s:vj2Ie

Score

10^/10

asyncrat traficokalelsiano persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

TRAFICOKALELSIANO

141.95.84.40:911

Mutex

awcasawca32wvawva3wvaw

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2960-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2960-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2960-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2960-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2960-77-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Khalifa_IMGS_2023720201617.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Khalifa_IMGS_2023720201617.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Khalifa_IMGS_2023720201618.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Khalifa_IMGS_2023720201618.vbs	wscript.exe

Loads dropped DLL 4 IoCs

pid	Process
2880	regsvr32.exe
2832	wscript.exe
2884	regsvr32.exe
2012	regsvr32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 2960	2832	wscript.exe	31
PID 2832 set thread context of 2596	2832	wscript.exe	33
PID 2832 set thread context of 2720	2832	wscript.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Wow6432Node	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2832	1548	WScript.exe	29
PID 1548 wrote to memory of 2832	1548	WScript.exe	29
PID 1548 wrote to memory of 2832	1548	WScript.exe	29
PID 1548 wrote to memory of 2832	1548	WScript.exe	29
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2880	2832	wscript.exe	30
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2960	2832	wscript.exe	31
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2884	2832	wscript.exe	32
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2596	2832	wscript.exe	33
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2012	2832	wscript.exe	34
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35
PID 2832 wrote to memory of 2720	2832	wscript.exe	35

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Mia_Khalifa_IMGS.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\syswow64\wscript.exe
  "C:\Windows\syswow64\wscript.exe" //b //e:vbscript "C:\Users\Admin\AppData\Local\Temp\Mia_Khalifa_IMGS.vbs"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2880
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
memory/2720-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2832-60-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2832-87-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/2832-74-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2960-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads