Analysis
-
max time kernel
208s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
23-04-2024 21:16
General
-
Target
lMG_MlaKhlfa1111HD_14546.vbs
-
Size
255KB
-
MD5
b921e66031316c979fac97b7012990ce
-
SHA1
01c4d314a23b6bd8b571b302c3483b7be904309f
-
SHA256
82d21f05aa27eb85e5244cd11a3e60b39093942d19ac86e20b96a280e9579544
-
SHA512
c0085dd5bc5595ff00a091361def95d92c3260a66e2c84c2aa2d54d2a48b3c5249d071e1db240d1ba2a5c26fc7b9d79122d9b0df55a1a4008025813d0839986f
-
SSDEEP
3072:Q03pA03pp03pmAk79DqcPKrB5jzeTMJNHEPenFkCum03pvfpp03pp03pp03pA:wk79DqcyrBJeQJhEPeQr5
Malware Config
Extracted
asyncrat
1.0.7
ADFLYYYY
139.99.133.66:6666
acwwcawwacwvasasa
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
remcos
ADFLY
139.99.133.66:4444
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
asasasas-SEG6JT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
xenorat
139.99.133.66
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
9999
-
startup_name
nothingset
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 15 IoCs
-
Registers COM server for autorun 1 TTPs 24 IoCs
-
Suspicious use of SetThreadContext 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 52 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lMG_MlaKhlfa1111HD_14546.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSWOW64\WSCRIPT.EXE"C:\Windows\SYSWOW64\WSCRIPT.EXE" //b //e:vbscript "C:\Users\Admin\AppData\Local\Temp\lMG_MlaKhlfa1111HD_14546.vbs"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\remc1.vbs"' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\remc1.vbs"'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\remc1.vbs"6⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xeno.vbs"' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xeno.vbs"'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xeno.vbs"6⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StartSave.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
13KB
MD5e0b8dfd17b8e7de760b273d18e58b142
SHA1801509fb6783c9e57edc67a72dde3c62080ffbaf
SHA2564ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379
SHA512443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b
-
Filesize
1.1MB
MD5996ce58a48e655f549f5713f0e611f39
SHA1ecec7979eb9d83600ea972ccfd2bb140209e2bbc
SHA256f9dea360c36d495e10a397ae78412f08de99609916592275b73045b7df096dd2
SHA512f992b04057b3e99439c08c249b73ba2afaf6880a6dcf7e6d08413f23d7ce122f087ffd236b75dd2c1f1750123e974ab45569019231a3577d2be227336b6b7eef
-
Filesize
251KB
MD5ec80082e5d40e6c94a4682fd840870c4
SHA11904a6688379fd732ec76932e8fc1eec7896cbac
SHA25674451d6bcb1565ab921e98a30b8bb8f2450d286cba1766ebd204efe3d96a78c9
SHA512d3f6a9e44c0608d41cc6dd9dd17ef31a394c3dae099f0c592ef9763590445e072866c23618c6dfb39843a108321e972b5fa49e6377f6a2e4887df35be2075bc5
-
Filesize
7KB
MD5c57918cd6881609ae45a33540c3e5ae5
SHA1fd7e6aab4c214903be417e0d0d3d66cbdafb3308
SHA2560eba17a9929102337c1d294ad98eaecebe68487a8f4d8fe8de4f74c1d2e4e5aa
SHA512abac2c45d5ba0a9914454a599fec33a876b1360b30d864a03a9fcddac1572fde158fd2a31f83e64a187e5f30edaf5ea74e943fe535713603cd4ac8dbf79b0551
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
352KB