Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
22/04/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
0060fb9c58250aa849d76f18f3c86b616448fc3dd14cb39a1ec2e6bacf0e7819.ps1
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
General
- Target 0060fb9c58250aa849d76f18f3c86b616448fc3dd14cb39a1ec2e6bacf0e7819.ps1
- Size 13.0MB
- Sample240422-bdke4adc52
- SHA256 0060fb9c58250aa849d76f18f3c86b616448fc3dd14cb39a1ec2e6bacf0e7819
- MD5 4118db56d1d80f99f0d3d3879a3117e6
- SHA1 3f3a789063c36f6368ac4384f8e0536f75ea7553
- SHA512 d9a058a963bd07fdc862ee4d27aebb68d33eeb029ba530d814e98b12aad3818a846ccf6ec3304a8e353d0918731cee2144acf0d5c4ab4eacb1752ade3f4a0931
- SSDEEP 49152:GBED5pdeEG4eIW4j1DdIotiCjtBQJBvET:
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
ghshe.duckdns.org:8797
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1436 created 3296 1436 powershell.exe 56 - Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4744-21-0x0000015D9C780000-0x0000015D9C792000-memory.dmp family_asyncrat behavioral2/memory/4744-22-0x0000015DB52E0000-0x0000015DB52F0000-memory.dmp family_asyncrat - Detects file containing reversed ASEP Autorun registry keys 2 IoCs
resource yara_rule behavioral2/memory/4744-21-0x0000015D9C780000-0x0000015D9C792000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse behavioral2/memory/4744-22-0x0000015DB52E0000-0x0000015DB52F0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1436 powershell.exe 1436 powershell.exe 1436 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1436 powershell.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1436 powershell.exe Token: SeDebugPrivilege 4744 notepad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101 PID 1436 wrote to memory of 4744 1436 powershell.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0060fb9c58250aa849d76f18f3c86b616448fc3dd14cb39a1ec2e6bacf0e7819.ps12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:1820
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kadyzhrt.nd3.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512