asyncrat | 815a639ed1aa74caf81fa04dec9becf05d4283c4327ab2c0e1d4d6015a4d83c7

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9..ps1
Size 250KB
Sample240516-thcj6acf57
SHA256 815a639ed1aa74caf81fa04dec9becf05d4283c4327ab2c0e1d4d6015a4d83c7
MD5 65e8c23841a5790d282aa11c51671a1e
SHA1 3e9da56393062d1737b578cc8c07468c8e595ddb
SHA512 e60e8f4f5d8e7e51c7eea3d1722fd55d726800455e02215a929b62e47d4a4f4acf273f5e635c588d2107dc9282cf6a52ff8a7b53c2d4644422ab9a3f3bd85e4a
SSDEEP 6144:jhMHd8wF9VtLr3EXGpI5cGIE+QIicfMF31533Apu:iHt9VtLr3EXGpI5cGIsc0D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat topup execution rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

TOPUP

smartvodafone.duckdns.org:5001
smartvodafone.duckdns.org:5002
smartvodafone.duckdns.org:5003

Mutex

AsyncMutex_336325328OkPnk

Attributes

delay
3
install
false
install_file
disashop.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1132	powershell.exe
2308	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 2820	1132	powershell.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2308	powershell.exe
2308	powershell.exe
1132	powershell.exe
1132	powershell.exe
2820	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	2820	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1884	2308	powershell.exe	95
PID 2308 wrote to memory of 1884	2308	powershell.exe	95
PID 3428 wrote to memory of 4476	3428	WScript.exe	109
PID 3428 wrote to memory of 4476	3428	WScript.exe	109
PID 4476 wrote to memory of 1420	4476	cmd.exe	111
PID 4476 wrote to memory of 1420	4476	cmd.exe	111
PID 1420 wrote to memory of 1132	1420	cmd.exe	112
PID 1420 wrote to memory of 1132	1420	cmd.exe	112
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113
PID 1132 wrote to memory of 2820	1132	powershell.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\9..ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn mwxd /tr C:\ProgramData\mwxd\mwxd.vbE
  2⤵
  - Creates scheduled task(s)
  PID:1884

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\mwxd\mwxd.vbE"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\mwxd\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\cmd.exe
    CMD /C powershell -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\mwxd\dcjr.ps1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\mwxd\dcjr.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\ProgramData\mwxd\1.bat
Size 86B
SHA256 fadd62ac0114532067e37abf2f4f1c79a28b94e8499be9538a849335aa0e30ad
MD5 fd9ec5d1b91b9db30cfdfb613bffbaec
SHA1 e6ca892de8336bf19d562812cc0769880f053530
SHA512 8677c4d763406fe9c181acf299e79b35fab073f3f40ac9e95bc5c20300699a26a8daa0d1c8b4ea83f8056e0a7355a84c4796bc9f67f8add2c612660177929ae8
MD5 SHA1 SHA512

Submit Download

dcjr.ps1

Path C:\ProgramData\mwxd\dcjr.ps1
Size 249KB
SHA256 95ab23c86cf8d5cfb653959321fcafa77953e625ecd7cab5fe1c9152deac2578
MD5 138ef840d923a8cd3098557921a451ee
SHA1 810b4f822d77078a11966fc37615f21e74047896
SHA512 086d2f92210b2e8425b00c7ac6a9ad99811859b96766e991cbce4facacdc4776072869b1513433bb22349880146d416b4633c92f1e873593b8ac80b43a5c2cf4
SSDEEP 6144:rhMHd8wF9VtLr3EXGpI5cGIE+QIicfMF31533Apo:KHt9VtLr3EXGpI5cGIsc0J
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwxd.vbE

Path C:\ProgramData\mwxd\mwxd.vbE
Size 120B
SHA256 e25a70e28cf20d999f0aae0fcbffeda92fb96fab81c9dc52ac1f6e7898466a07
MD5 aaa8f549c2e7391fff3091a2b344c086
SHA1 63c8f3da57e517308ae8ac1de5705537cb7b8487
SHA512 411440fae2d0e30a6afce6cf03d5eeafeac3964540cbfdebe08af5acdc829459b77be3728e40367a0bb57fbcbd28c9ea48dfa594c604ce3b9ea623a6c2fee76b
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cce910fd370ca538c37d328df605fa870a09db90244ca17cde0cc75ac059edc
MD5 edff8411b90eb97d31dd00831bd9afb2
SHA1 29af749a3576d0c88c54e75c63ec59579dfe2b2d
SHA512 fa9bd63dcdb2934705f186edcf5db38009573e9e304ec2b21de47387c27acf51d84e4f61ebc98d22812d1b7df4c70a2354e4a623368b50d8c0f15aca25fb34e8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_g4dcag1b.3a0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4dcag1b.3a0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1132-36-0x000001F97C930000-0x000001F97C936000-memory.dmp

Download

memory/1132-35-0x000001F97A560000-0x000001F97A578000-memory.dmp

Download

memory/2308-20-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Download

memory/2308-12-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Download

memory/2308-11-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Download

memory/2308-10-0x000002357BD70000-0x000002357BD92000-memory.dmp

Download

memory/2308-0-0x00007FFE5BD23000-0x00007FFE5BD25000-memory.dmp

Download

memory/2820-37-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2820-39-0x00000000060B0000-0x0000000006654000-memory.dmp

Download

memory/2820-40-0x0000000005CE0000-0x0000000005D72000-memory.dmp

Download

memory/2820-41-0x0000000005CC0000-0x0000000005CCA000-memory.dmp

Download

memory/2820-42-0x00000000068A0000-0x000000000693C000-memory.dmp

Download

memory/2820-43-0x0000000006940000-0x00000000069A6000-memory.dmp

Download