Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 11:02
Static task
static1
Behavioral task
behavioral1
Sample
0f66ff679ac2376c3f317f09cce13220.ps1
Resource
win7-20231215-en
General
-
Target
0f66ff679ac2376c3f317f09cce13220.ps1
-
Size
103KB
-
MD5
0f66ff679ac2376c3f317f09cce13220
-
SHA1
dc4cc0139395fb9b79fa760762f609f9a40ad552
-
SHA256
5c3603c16f14470925cb27d1448e3e74f73041ddb767378da24fe196e9289551
-
SHA512
12576d365a832f35cf946b846c325a30f349334a70112ecc2b3a053d8944ebe4265c29bf8057656ecd77deafa5c7a4e4b5bbe0f82e2d546b523745add4cadd5e
-
SSDEEP
1536:EUKQoDt+kNmfZxz0enLSOybC07jwSMgE6Dis9GLTG:NrG
Malware Config
Extracted
asyncrat
0.5.7B
love
arieldon.linkpc.net:4444
77.247.127.24:4444
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/380-28-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 696 set thread context of 380 696 powershell.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 696 powershell.exe 696 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 696 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
powershell.execsc.exedescription pid process target process PID 696 wrote to memory of 1220 696 powershell.exe csc.exe PID 696 wrote to memory of 1220 696 powershell.exe csc.exe PID 1220 wrote to memory of 492 1220 csc.exe cvtres.exe PID 1220 wrote to memory of 492 1220 csc.exe cvtres.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe PID 696 wrote to memory of 380 696 powershell.exe RegAsm.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0f66ff679ac2376c3f317f09cce13220.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfxgqkwd\gfxgqkwd.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71D4.tmp" "c:\Users\Admin\AppData\Local\Temp\gfxgqkwd\CSC60621704D7BF412190F670173F9D22D1.TMP"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES71D4.tmpFilesize
1KB
MD52eb01629080eef02d9d17cd14434e0b4
SHA1a9152115aad8e6cbf38ee47c4be23f8a6643ebcd
SHA256a936b19d05b9d47196c310b4beb29c83137524e67163a12b7875fada7a9211fb
SHA512a18e96c23ea805dfe5c07fc83e9f04566ca3368fc2ae15de5495d8c1ee584f2f7d9d0da605d3514802b6f81b6b017250c40cf65f5ea50ae6ad952c8d6f158820
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bksi4e52.dxm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\gfxgqkwd\gfxgqkwd.dllFilesize
13KB
MD59407e78c3a686af09db12df58e9d6ab5
SHA1fb4bb68ea0fbb8314813804ba5a5310fbe82cbf5
SHA2563ac6c35e6be5f6bdbab0071c4daacb9e858a426f6065fbd2307de15301b1244e
SHA512c887baa67a7ba78d57de9676f53954d2e52ecd34c5c866d0462068c4139ee7ab5e090343292cfe1439959060e0e6895ab87f3384847ae5e0ec4b043b62ec1fc8
-
\??\c:\Users\Admin\AppData\Local\Temp\gfxgqkwd\CSC60621704D7BF412190F670173F9D22D1.TMPFilesize
652B
MD5718908942d7ea95d26325f8550aa336c
SHA18bcbfad983a6277e31d8127b7f0fee242a21d0a0
SHA256217c9e06b3f9fc991a8355550947280a3f762dc3f44545d11d1a430454021f2a
SHA5122d7c4bceb812d34b2c94ef031271bc3660cb0912936805dfb3fbdddfc6f6c91804256d465f095aa9e5a8c64729fb6c615f6510abcc9a67ce12a270e4969c1d98
-
\??\c:\Users\Admin\AppData\Local\Temp\gfxgqkwd\gfxgqkwd.0.csFilesize
13KB
MD5e03b1e7ba7f1a53a7e10c0fd9049f437
SHA13bb851a42717eeb588eb7deadfcd04c571c15f41
SHA2563ca2d456cf2f8d781f2134e1481bd787a9cb6f4bcaa2131ebbe0d47a0eb36427
SHA512a098a8e2a60a75357ee202ed4bbe6b86fa7b2ebae30574791e0d13dcf3ee95b841a14b51553c23b95af32a29cc2265afc285b3b0442f0454ea730de4d647383f
-
\??\c:\Users\Admin\AppData\Local\Temp\gfxgqkwd\gfxgqkwd.cmdlineFilesize
327B
MD57cc161d16c80d015bfad41b64d3f4bbb
SHA141583fb7016e631ff539ae8acc98bf8e707048a5
SHA256f61d343fb46d53631759ac783d0e722f4167136b9fbd40c79a24d6138b6c9494
SHA5128bd6595268a40e01cecaf72c7187522b14d73bf476c724a98656fdc1a8b91d65ed37814791781ab12410e2ce2b9f597c902c332a8499639f1acb7d50e757e366
-
memory/380-28-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/380-32-0x0000000074370000-0x0000000074B20000-memory.dmpFilesize
7.7MB
-
memory/380-33-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/380-34-0x0000000074370000-0x0000000074B20000-memory.dmpFilesize
7.7MB
-
memory/380-35-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/696-13-0x000001D1580F0000-0x000001D158166000-memory.dmpFilesize
472KB
-
memory/696-12-0x000001D157230000-0x000001D157240000-memory.dmpFilesize
64KB
-
memory/696-11-0x000001D157230000-0x000001D157240000-memory.dmpFilesize
64KB
-
memory/696-10-0x00007FFE7E910000-0x00007FFE7F3D1000-memory.dmpFilesize
10.8MB
-
memory/696-26-0x000001D157B70000-0x000001D157B7A000-memory.dmpFilesize
40KB
-
memory/696-9-0x000001D157B20000-0x000001D157B42000-memory.dmpFilesize
136KB
-
memory/696-31-0x00007FFE7E910000-0x00007FFE7F3D1000-memory.dmpFilesize
10.8MB