Overview

overview

10

Static

static

1

D24112509FA.js

windows7-x64

10

D24112509FA.js

windows10-2004-x64

10

Analysis

  • max time kernel
    297s
  • max time network
    304s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 02:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    D24112509FA.js

  • Size

    1.5MB

  • MD5

    54c0bfbfcf8e54a84687ad887f352661

  • SHA1

    72396d5febe2bfaac6e5d32b68b7e248af5b5939

  • SHA256

    a1799891e1d46497c6aff689f8aacda09ef5e825dd700d6fce2aa3e4ddf638b6

  • SHA512

    61f7783c27ff34f112a721cfee73218229eedc93853b60e3544ff6f9642f7a74e77f11dfcee2f7380af34030ae4a4f84850d038d357ee0b9fb5ba9a8c3ec91a2

  • SSDEEP

    12288:LtVY8xmih31uN1CJ56AmZxZYXiu5rRUSzBZK+9wmecq4uDgnA9HceADyr0RwKNCt:xVKJN4JYAL7r1jgcBObQ3K08YzmYs

Score
10/10
asyncratwshratdefault-nov-24discoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default-NOV-24

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:7031

jinvestments.duckdns.org:2703

jinvestments.duckdns.org:7031
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Windows Update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7044

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Wshrat family
    wshrat
  • Blocklisted process makes network request 53 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 53 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\D24112509FA.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\adobe.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:2732
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.js"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
        "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF02.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2312
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:436
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:592
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"' & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1984
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"'
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2272
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE669.tmp.bat""
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2552
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:1088
            • C:\Users\Admin\AppData\Roaming\Windows Update.exe
              "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:936
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2612
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmp558F.tmp"
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:1408
              • C:\Users\Admin\AppData\Roaming\Windows Update.exe
                "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
                7⤵
                • Executes dropped EXE
                PID:1748
              • C:\Users\Admin\AppData\Roaming\Windows Update.exe
                "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
                7⤵
                • Executes dropped EXE
                PID:1456
              • C:\Users\Admin\AppData\Roaming\Windows Update.exe
                "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
    Filesize

    613KB

    MD5

    3a581f3b380d9e4f8ad2eb3962398b90

    SHA1

    c1842a583d793972040d03a4901b0b63f0e97d65

    SHA256

    7ac3a47cb8196aae573d5855ce43ac0498f18281e4b9ff626f53eaf220c1fdc5

    SHA512

    7b03db127ccb8d1f98f465a52a82187cdb12ce17b651353db25a29d59e37cc1119aa9454d05a04853e5d0ffbbdba45833a10ea6e08e10b13878f7f5b7acb3a2e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\adobe.js
    Filesize

    305KB

    MD5

    98d77a83c389bb812e0838c391b73258

    SHA1

    f543f656670ab8abfc78b06d8331b4c4a70c3df2

    SHA256

    177fa36898fbdb539116997091efff95984ccbd64a8a2b022f0557424a6fd915

    SHA512

    5f0bdc882df3a6eb86645d765b5c7d320c62ac278e8bee43e11742236dc60d1209ee7be50e7540ac94f710ab46280f5e5b46f8913d30a23c25b1403de4842ea8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svchost.js
    Filesize

    839KB

    MD5

    198a3620008e85b96e716688e6c9f8bb

    SHA1

    e61d0552a7aa2b4815e21fd955e335679af56d5e

    SHA256

    a28853b5fb6657f6491856b90e64381c197a3f7aa40a0a09199a5e9d61502bd3

    SHA512

    fa3d09906173ea98277266366daf5b47c9d44387b83fda3a1ec5a1ef6dda08b20f2b6344b6138421a0b98f16e44e0b147280ef490d9902ddfdca1268590cfbbc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpCF02.tmp
    Filesize

    1KB

    MD5

    1203e26ab2c04e33b762daa88dcbdf07

    SHA1

    e158bf86e999f805d0aea51f1173af0acfbaa7ad

    SHA256

    81a0e5b12d740c02782321e748253da506f9e240539d56a651806fe74e5189dd

    SHA512

    b49dbb75aa8e6a6eb3ae5e49b6f78a0cbdf558a4f3ef535c03fdfd9208a3d4deb37df8c9c6fb12ccb8fadd5a323ee7b060755858407f642dd7b31b42da3ac46b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpE669.tmp.bat
    Filesize

    158B

    MD5

    ba67a71ee38538caff7b6922650ca40d

    SHA1

    43a6a7f127dd93ebfcbd768aad6f4484c73f64bb

    SHA256

    bfd376001aa9b79f31aa8199ed9a83d5a7b32c5d4744b8be8aef46de227f955b

    SHA512

    c1f742ef22f1fb2e46e0d857aa31d43e2679d0754ebefd871167466659bd9de5ae2a927b57a17939d695b0b081bb9bcc6c0c948974f4733b346c7c7c3cf3ef45

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    e1cc47efa3a1b15e61cc7937f0d54aed

    SHA1

    b9dee62897ef5e5a974343853c43226ee80015f7

    SHA256

    d36c8d105d8b1df496f42317b98309e5a8ddcfba5e46792066d3b251a44e913a

    SHA512

    e8f6f50cedc10f77d1fcd10d73ccd89fbd20219f6265e467aa6bca7bd769e10085e527e7698d1123cf5c04ce5c8af089a89f279d51d6cec524b9265438dd29f5

    Download Submit

  • memory/592-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/592-39-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-46-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-43-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-41-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-48-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-49-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/592-37-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/616-89-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/616-84-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/616-87-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/936-64-0x00000000001A0000-0x000000000023C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2836-20-0x0000000000C00000-0x0000000000C9C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2836-21-0x0000000000890000-0x00000000008AC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2836-24-0x0000000004B90000-0x0000000004BE6000-memory.dmp

    Filesize

    344KB

    Download