Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 17:41

General

  • Target

    16112023_0141_15112023_Invoice#2356876431_8X.ps1

  • Size

    424KB

  • MD5

    a4f5f2b9250e61e89e53a30f976a4823

  • SHA1

    8f5bcdfdc3b3b7081d03e60b8af2b377273fe2fb

  • SHA256

    0979a391997dc0b6bdf23949b5f99ea2ef1cf51287c63b7332bbd498e5cf9514

  • SHA512

    9955f9951e1eb74287a69bc9a2fac68ac2f3d4e96e3f12ec238090a7a7044771f20628d02d2562319e22f537e98ff7196d56d2f74c6a7af7b2276a0e23cf2e33

  • SSDEEP

    3072:YLxEUM7rH9yLY9K9J7xV1G+uadUEAGnTBdjaATUfWwLC5ImBK5W9Fp81fABAUves:YLxEUM7rH9yLY9K9ZTUOwqYyfbZ

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Sended@

C2

hexrxr.duckdns.org:6606

hexrxr.duckdns.org:7707

hexrxr.duckdns.org:8808

Mutex

AsyncMutex_85&$nkeo4%hifbe

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\16112023_0141_15112023_Invoice#2356876431_8X.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1780
  • C:\Windows\System32\WScript.exe
    C:\Windows\System32\WScript.exe "C:\Users\Public\Conted.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Conted.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\Conted.ps1'"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          2f57fde6b33e89a63cf0dfdd6e60a351

          SHA1

          445bf1b07223a04f8a159581a3d37d630273010f

          SHA256

          3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

          SHA512

          42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          58b97594c4d764d5d99a459fbee0fd33

          SHA1

          4d1f8f4f5bbf87a6ea3ae7b7be623542377365da

          SHA256

          8001b17515105615ae767a048f98b1c1d211130f7c8c7e9bb585cf063b0c6db2

          SHA512

          874c700052930cfc7bc99e3e0353bf3a3891e45854df7982f73a2fa4d8a60546d683fae0163104e047991955d7d6b8950447be83a93d99ae9d9931a1e13e3cf7

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q5hwxby2.y24.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Public\Conted.bat

          Filesize

          205B

          MD5

          759278dd3dc3679bf7efd1ec681c0aa1

          SHA1

          72b37494696deea940ac75b4c4e06e2b6ce419ef

          SHA256

          cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19

          SHA512

          8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f

        • C:\Users\Public\Conted.ps1

          Filesize

          422KB

          MD5

          ba03b4e7a4ad2bd4a2f5bce388d8f489

          SHA1

          f71681ee8115d4349084ad5c26e790a926bbea84

          SHA256

          d6b98f02b41a30cd4578acfd549e2d6fe64036f00c1830193d342c0454068b5a

          SHA512

          6dc307567baa0a1def8b9e480477985ccbdb7e5628c4d972a5804b282006d0717ddd728c449f8fbfcd2669a1a868c516d5924ab3a1f3d1b8e4bd1272fc04c665

        • C:\Users\Public\Conted.vbs

          Filesize

          688B

          MD5

          110da9d3474ba64fa1a18c173685c25d

          SHA1

          9f093829518a9268bf9807fda7bef47e7832c497

          SHA256

          a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60

          SHA512

          ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443

        • memory/1688-37-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

        • memory/1688-46-0x0000000005E60000-0x0000000005EC6000-memory.dmp

          Filesize

          408KB

        • memory/1688-45-0x0000000005DC0000-0x0000000005E5C000-memory.dmp

          Filesize

          624KB

        • memory/1688-44-0x00000000054B0000-0x00000000054BA000-memory.dmp

          Filesize

          40KB

        • memory/1688-42-0x00000000056D0000-0x0000000005C74000-memory.dmp

          Filesize

          5.6MB

        • memory/1688-43-0x0000000005310000-0x00000000053A2000-memory.dmp

          Filesize

          584KB

        • memory/1688-40-0x0000000074D20000-0x00000000754D0000-memory.dmp

          Filesize

          7.7MB

        • memory/1688-41-0x0000000002780000-0x0000000002790000-memory.dmp

          Filesize

          64KB

        • memory/1780-12-0x0000014E68FE0000-0x0000014E68FF0000-memory.dmp

          Filesize

          64KB

        • memory/1780-11-0x0000014E68FE0000-0x0000014E68FF0000-memory.dmp

          Filesize

          64KB

        • memory/1780-18-0x00007FFDD7E30000-0x00007FFDD88F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1780-10-0x00007FFDD7E30000-0x00007FFDD88F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1780-9-0x0000014E697D0000-0x0000014E697F2000-memory.dmp

          Filesize

          136KB

        • memory/4660-23-0x000002D75B540000-0x000002D75B550000-memory.dmp

          Filesize

          64KB

        • memory/4660-39-0x00007FFDD78B0000-0x00007FFDD8371000-memory.dmp

          Filesize

          10.8MB

        • memory/4660-36-0x000002D75B480000-0x000002D75B49A000-memory.dmp

          Filesize

          104KB

        • memory/4660-24-0x000002D75B540000-0x000002D75B550000-memory.dmp

          Filesize

          64KB

        • memory/4660-22-0x00007FFDD78B0000-0x00007FFDD8371000-memory.dmp

          Filesize

          10.8MB