Malware Analysis Report

2024-08-06 12:59

Sample ID 240604-b57ppshg58
Target a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js
SHA256 a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d
Tags
asyncrat execution rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d

Threat Level: Known bad

The file a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js was found to be: Known bad.

Malicious Activity Summary

asyncrat execution rat

AsyncRat

Detects executables packed with ConfuserEx Mod

Async RAT payload

Downloads MZ/PE file

Blocklisted process makes network request

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Creates scheduled task(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
JavaScript
T1059.007
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:44

Reported

2024-06-04 01:47

Platform

win7-20240508-en

Max time kernel

147s

Max time network

148s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2720 set thread context of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1632 set thread context of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Windows\system32\wscript.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 2720 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1656 wrote to memory of 2720 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1656 wrote to memory of 2720 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1656 wrote to memory of 2720 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2720 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 2500 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2584 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2584 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2584 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2584 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2584 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 2584 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 2584 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 2584 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 1632 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

"C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe"

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

"C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "audio" /tr '"C:\Users\Admin\AppData\Local\Temp\audio.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "audio" /tr '"C:\Users\Admin\AppData\Local\Temp\audio.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\audio.exe

"C:\Users\Admin\AppData\Local\Temp\audio.exe"

C:\Users\Admin\AppData\Local\Temp\audio.exe

"C:\Users\Admin\AppData\Local\Temp\audio.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 electrikar.com.mx udp
US 157.230.6.220:443 electrikar.com.mx tcp
US 8.8.8.8:53 chongmei33.publicvm.com udp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
US 8.8.8.8:53 chonglee575.duckdns.org udp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp
US 8.8.8.8:53 chonglee575.duckdns.org udp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp
LV 141.101.134.51:49746 chonglee575.duckdns.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

MD5 f672108901b809c33d38bb6801c9b273
SHA1 b5d45949ba7d38b92c20d31cfcae6d437dea8c18
SHA256 90e5d1dba754723f6b34acbc974c65467495605f197857569a7ff211aeffca7f
SHA512 6f0cae9ca529b197fd5464c6d929437fadfc5c6c36aee5fc7fce1425d5e94cd8a90573c486c339df79ca75b532ef21d9105981eb7650c652db1abc6401c73c25

memory/2720-19-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2720-20-0x00000000012B0000-0x0000000001366000-memory.dmp

memory/2720-21-0x00000000002E0000-0x00000000002F4000-memory.dmp

memory/2720-22-0x0000000000300000-0x0000000000308000-memory.dmp

memory/2500-34-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-31-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2500-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-25-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-35-0x0000000000660000-0x0000000000688000-memory.dmp

memory/2720-37-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2500-36-0x0000000000930000-0x0000000000956000-memory.dmp

memory/2500-38-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2500-39-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2500-40-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-93-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-91-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-89-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-87-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-85-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-83-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-81-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-79-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-77-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-75-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-73-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-71-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-69-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-67-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-65-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-63-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-61-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-59-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-57-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-55-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-53-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-51-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-49-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-47-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-45-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-43-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-41-0x0000000000930000-0x0000000000950000-memory.dmp

memory/2500-354-0x0000000074620000-0x0000000074D0E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.bat

MD5 c31b1379daea60de586a4286271712af
SHA1 4a6edb28fb49ae68ed2bc798c2e6d17cfbb99b4a
SHA256 3c2a49deb3e750c7c47633959ee419c38fc5487b2806d62a5739d204985bdb36
SHA512 047cdbdd03280239314af4a87e6d7f464e67124b980a808d6092e210adaad81585450779fd23cdfe5c1b7f2f2c279036a699bb4b4bdb70f333766c85a3d479a1

memory/2500-364-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/1632-368-0x0000000000C40000-0x0000000000CF6000-memory.dmp

memory/2720-698-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2720-699-0x0000000074620000-0x0000000074D0E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 01:44

Reported

2024-06-04 01:47

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1736 set thread context of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 4216 set thread context of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\audio.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4760 wrote to memory of 1736 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 4760 wrote to memory of 1736 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 4760 wrote to memory of 1736 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1736 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe
PID 1972 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3032 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3032 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3032 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 3032 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 3032 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe
PID 4216 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\audio.exe C:\Users\Admin\AppData\Local\Temp\audio.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d.js

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

"C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe"

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

"C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe"

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

"C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "audio" /tr '"C:\Users\Admin\AppData\Local\Temp\audio.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp513D.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "audio" /tr '"C:\Users\Admin\AppData\Local\Temp\audio.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\audio.exe

"C:\Users\Admin\AppData\Local\Temp\audio.exe"

C:\Users\Admin\AppData\Local\Temp\audio.exe

"C:\Users\Admin\AppData\Local\Temp\audio.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 electrikar.com.mx udp
US 157.230.6.220:443 electrikar.com.mx tcp
US 8.8.8.8:53 220.6.230.157.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 chonglee575.duckdns.org udp
LV 141.101.134.51:49746 chonglee575.duckdns.org tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
LV 141.101.134.51:49746 chonglee575.duckdns.org tcp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chongmei33.publicvm.com udp
SE 46.246.12.5:49746 chongmei33.publicvm.com tcp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
SE 46.246.12.5:2703 chongmei33.publicvm.com tcp
US 8.8.8.8:53 chonglee575.duckdns.org udp
LV 141.101.134.51:49746 chonglee575.duckdns.org tcp
LV 141.101.134.51:6974 chonglee575.duckdns.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\SGUDBQ.exe

MD5 f672108901b809c33d38bb6801c9b273
SHA1 b5d45949ba7d38b92c20d31cfcae6d437dea8c18
SHA256 90e5d1dba754723f6b34acbc974c65467495605f197857569a7ff211aeffca7f
SHA512 6f0cae9ca529b197fd5464c6d929437fadfc5c6c36aee5fc7fce1425d5e94cd8a90573c486c339df79ca75b532ef21d9105981eb7650c652db1abc6401c73c25

memory/1736-17-0x000000007449E000-0x000000007449F000-memory.dmp

memory/1736-18-0x0000000000470000-0x0000000000526000-memory.dmp

memory/1736-19-0x00000000055D0000-0x0000000005B74000-memory.dmp

memory/1736-20-0x0000000004F00000-0x0000000004F92000-memory.dmp

memory/1736-21-0x0000000004E80000-0x0000000004E94000-memory.dmp

memory/1736-22-0x0000000004EA0000-0x0000000004EA8000-memory.dmp

memory/1972-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1972-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1972-29-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1972-30-0x000000007449E000-0x000000007449F000-memory.dmp

memory/1736-28-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1972-31-0x0000000002F70000-0x0000000002F98000-memory.dmp

memory/1972-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1972-32-0x0000000003170000-0x0000000003196000-memory.dmp

memory/1972-33-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1972-34-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1972-94-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-272-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1972-82-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-80-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-78-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-76-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-74-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-72-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-70-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-69-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-66-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-64-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-62-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-60-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-58-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-56-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-52-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-50-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-46-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-44-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-40-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-38-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-36-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-35-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-92-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-90-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-88-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-86-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-84-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-54-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-48-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-42-0x0000000003170000-0x0000000003190000-memory.dmp

memory/1972-350-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1972-351-0x0000000005770000-0x000000000580C000-memory.dmp

memory/1972-356-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1972-357-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp513D.tmp.bat

MD5 63ee96e6a3805f90a2015681d63ebb72
SHA1 6c1a79e49c01fe253c06fd2bf9ddc49c6e9e26e7
SHA256 39084130295ff8f98f7c1587be96ab3ad6cdea72639551f043a7cc42907de2bf
SHA512 622e1b8e0d5716caac0fe8568e6376359453e147c36568c227b8fee2dc4dce9616420a3f5d95dc58f528b62ec10da14605f6332242713fffa6b97195a85e61a8

memory/1736-680-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1736-679-0x000000007449E000-0x000000007449F000-memory.dmp