Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
29/04/2024, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
a94694b8af1007df4ae8704991dc121bc58949e2ef04288db9137f72750439f8.ps1
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
- Target a94694b8af1007df4ae8704991dc121bc58949e2ef04288db9137f72750439f8.ps1
- Size 12.0MB
- Sample240429-ce7sfsfa45
- SHA256 a94694b8af1007df4ae8704991dc121bc58949e2ef04288db9137f72750439f8
- MD5 f0d4959e7904560319798a82d238c19c
- SHA1 3f54ae4210a8831bdf2c39f6ee9fb34afed1c6ae
- SHA512 4c40262c2abda0e37e81f62a1a541a49eed8341bfdeefccf11e07e30ff6fdbfc81ba956a7b5fedd08aa305d5daa86ee75dd79b55e64369caade97e049e28e78b
- SSDEEP 24576:rktiItcNIcBzNpTsPf7mxsOxd2MFYcNEeHktILchLvbXOCLC4iQnH/U0UiQ8CWVk:qCCioq3HlktJ6RM6uo7EzjQYdd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
hjdsasync.duckdns.org:8797
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2120 created 3436 2120 powershell.exe 56 - Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2800-17-0x00000273FE4B0000-0x00000273FE4C2000-memory.dmp family_asyncrat - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2120 powershell.exe 2120 powershell.exe 2120 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2120 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2120 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87 PID 2120 wrote to memory of 2800 2120 powershell.exe 87
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a94694b8af1007df4ae8704991dc121bc58949e2ef04288db9137f72750439f8.ps12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵PID:2800
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_to0hfzbp.5cr.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512