Analysis
- max time kernel
142s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
17/05/2024, 01:53
General
- Target file01.ps1
- Size 699KB
- Sample240517-ca144sbh91
- SHA256 ab6c409a1342807f44c736a608856d57c242bde28be16ab6c0be7dfa188b65e7
Malware Config
Extracted
-
asyncrat
-
| Cracked by Mekho RAT
-
New Resulit
-
servicem.mywire.org:555
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_oiijpsy2.am5.ps1
memory/2900-50-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2900-66-0x00000000057E0000-0x00000000057F0000-memory.dmp
memory/2900-65-0x000000007528E000-0x000000007528F000-memory.dmp
memory/2900-64-0x00000000068C0000-0x0000000006926000-memory.dmp
memory/2900-63-0x0000000006DA0000-0x0000000006E3C000-memory.dmp
memory/2900-60-0x0000000005B80000-0x0000000005B8A000-memory.dmp
memory/2900-59-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/2900-58-0x0000000005FA0000-0x0000000006544000-memory.dmp
memory/2900-57-0x00000000057E0000-0x00000000057F0000-memory.dmp
memory/2900-54-0x000000007528E000-0x000000007528F000-memory.dmp
memory/5064-25-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-29-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-37-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-35-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-33-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-31-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-27-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-0-0x00007FF917AA3000-0x00007FF917AA5000-memory.dmp
memory/5064-23-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-21-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-19-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-17-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-15-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-39-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-14-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-53-0x00007FF917AA0000-0x00007FF918561000-memory.dmp
memory/5064-56-0x0000022464A70000-0x0000022464A80000-memory.dmp
memory/5064-55-0x0000022464B50000-0x0000022464B51000-memory.dmp
memory/5064-49-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-41-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-43-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-45-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-47-0x0000022464D20000-0x0000022464D41000-memory.dmp
memory/5064-13-0x0000022464D20000-0x0000022464D48000-memory.dmp
memory/5064-12-0x00007FF917AA0000-0x00007FF918561000-memory.dmp
memory/5064-11-0x00007FF917AA0000-0x00007FF918561000-memory.dmp
memory/5064-6-0x0000022464CF0000-0x0000022464D12000-memory.dmp