Overview

overview

10

Static

static

1

D24112509FA.js

windows7-x64

10

D24112509FA.js

windows10-2004-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2024, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    D24112509FA.js
  • Size 1.5MB
  • Sample241126-cfa5wayjcs
  • SHA256 a1799891e1d46497c6aff689f8aacda09ef5e825dd700d6fce2aa3e4ddf638b6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratwshratdefault-nov-24discoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default-NOV-24

C2

  • chongmei33.publicvm.com:2703

  • chongmei33.publicvm.com:7031

  • jinvestments.duckdns.org:2703

  • jinvestments.duckdns.org:7031

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Windows Update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • wshrat

C2

  • http://chongmei33.publicvm.com:7044

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Wshrat family
    wshrat
  • Blocklisted process makes network request 54 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 54 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\D24112509FA.js
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\adobe.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:4792
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.js"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:620
      • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
        "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2876
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1364.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2044
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:3508
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:3160
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:4340
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:1940
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"' & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"'
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4500
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.bat""
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3668
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:3204
            • C:\Users\Admin\AppData\Roaming\Windows Update.exe
              "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:620
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4104
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp"
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3260
              • C:\Users\Admin\AppData\Roaming\Windows Update.exe
                "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4640

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Ucopa.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ucopa.exe.log
        • Size 1KB
        • SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
        • MD5 SHA1 SHA512
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 a5027aac97d4276d92c9f82b6630da0e155145b7fa059be43a65f86d177d1154
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ucopa.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
        • Size 613KB
        • SHA256 7ac3a47cb8196aae573d5855ce43ac0498f18281e4b9ff626f53eaf220c1fdc5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        __PSScriptPolicyTest_rzmwj5tt.jdh.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzmwj5tt.jdh.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512
        Submit Download

        adobe.js
        • Path C:\Users\Admin\AppData\Local\Temp\adobe.js
        • Size 305KB
        • SHA256 177fa36898fbdb539116997091efff95984ccbd64a8a2b022f0557424a6fd915
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svchost.js
        • Path C:\Users\Admin\AppData\Local\Temp\svchost.js
        • Size 839KB
        • SHA256 a28853b5fb6657f6491856b90e64381c197a3f7aa40a0a09199a5e9d61502bd3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp1364.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp1364.tmp
        • Size 1KB
        • SHA256 14452927e3f0ec21efe6eba7fabe485f5cf36a7bd0513ce440e9089aba4af772
        • MD5 SHA1 SHA512
        Submit Download

        tmp249A.tmp.bat
        • Path C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.bat
        • Size 158B
        • SHA256 81649a3c0a939d48e407aa8010a3848ee932263c627af3f5009d7bf566b118ad
        • MD5 SHA1 SHA512
        Submit Download

        memory/1968-26-0x0000000005580000-0x0000000005B24000-memory.dmp
        Download

        memory/1968-33-0x00000000066E0000-0x0000000006736000-memory.dmp
        Download

        memory/1968-30-0x0000000005400000-0x000000000541C000-memory.dmp
        Download

        memory/1968-29-0x0000000005320000-0x00000000053BC000-memory.dmp
        Download

        memory/1968-28-0x0000000005250000-0x000000000525A000-memory.dmp
        Download

        memory/1968-27-0x00000000050B0000-0x0000000005142000-memory.dmp
        Download

        memory/1968-25-0x0000000000620000-0x00000000006BC000-memory.dmp
        Download

        memory/2876-64-0x0000000006780000-0x00000000067CC000-memory.dmp
        Download

        memory/2876-83-0x0000000007C10000-0x0000000007C21000-memory.dmp
        Download

        memory/2876-61-0x00000000060B0000-0x0000000006404000-memory.dmp
        Download

        memory/2876-63-0x00000000066F0000-0x000000000670E000-memory.dmp
        Download

        memory/2876-52-0x0000000005DC0000-0x0000000005E26000-memory.dmp
        Download

        memory/2876-65-0x00000000076A0000-0x00000000076D2000-memory.dmp
        Download

        memory/2876-66-0x00000000713F0000-0x000000007143C000-memory.dmp
        Download

        memory/2876-76-0x0000000006C90000-0x0000000006CAE000-memory.dmp
        Download

        memory/2876-77-0x00000000078E0000-0x0000000007983000-memory.dmp
        Download

        memory/2876-78-0x0000000008060000-0x00000000086DA000-memory.dmp
        Download

        memory/2876-79-0x0000000007A10000-0x0000000007A2A000-memory.dmp
        Download

        memory/2876-80-0x0000000007A90000-0x0000000007A9A000-memory.dmp
        Download

        memory/2876-82-0x0000000007C90000-0x0000000007D26000-memory.dmp
        Download

        memory/2876-50-0x0000000005610000-0x0000000005632000-memory.dmp
        Download

        memory/2876-84-0x0000000007C40000-0x0000000007C4E000-memory.dmp
        Download

        memory/2876-85-0x0000000007C50000-0x0000000007C64000-memory.dmp
        Download

        memory/2876-86-0x0000000007D50000-0x0000000007D6A000-memory.dmp
        Download

        memory/2876-87-0x0000000007D30000-0x0000000007D38000-memory.dmp
        Download

        memory/2876-51-0x00000000056B0000-0x0000000005716000-memory.dmp
        Download

        memory/2876-40-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
        Download

        memory/2876-42-0x0000000005790000-0x0000000005DB8000-memory.dmp
        Download

        memory/2940-47-0x0000000000400000-0x0000000000412000-memory.dmp
        Download

        memory/4104-119-0x00000000061B0000-0x00000000061FC000-memory.dmp
        Download

        memory/4104-120-0x0000000071A50000-0x0000000071A9C000-memory.dmp
        Download

        memory/4104-130-0x00000000071C0000-0x00000000071D1000-memory.dmp
        Download

        memory/4104-131-0x0000000007200000-0x0000000007214000-memory.dmp
        Download