Overview

overview

10

Static

static

1

D24112509FA.js

windows7-x64

10

D24112509FA.js

windows10-2004-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 02:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    D24112509FA.js

  • Size

    1.5MB

  • MD5

    54c0bfbfcf8e54a84687ad887f352661

  • SHA1

    72396d5febe2bfaac6e5d32b68b7e248af5b5939

  • SHA256

    a1799891e1d46497c6aff689f8aacda09ef5e825dd700d6fce2aa3e4ddf638b6

  • SHA512

    61f7783c27ff34f112a721cfee73218229eedc93853b60e3544ff6f9642f7a74e77f11dfcee2f7380af34030ae4a4f84850d038d357ee0b9fb5ba9a8c3ec91a2

  • SSDEEP

    12288:LtVY8xmih31uN1CJ56AmZxZYXiu5rRUSzBZK+9wmecq4uDgnA9HceADyr0RwKNCt:xVKJN4JYAL7r1jgcBObQ3K08YzmYs

Score
10/10
asyncratwshratdefault-nov-24discoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default-NOV-24

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:7031

jinvestments.duckdns.org:2703

jinvestments.duckdns.org:7031
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Windows Update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7044

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Wshrat family
    wshrat
  • Blocklisted process makes network request 54 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 54 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\D24112509FA.js
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\adobe.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:4792
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.js"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:620
      • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
        "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2876
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1364.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2044
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:3508
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:3160
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:4340
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Executes dropped EXE
          PID:1940
        • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
          "C:\Users\Admin\AppData\Local\Temp\Ucopa.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"' & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Windows Update" /tr '"C:\Users\Admin\AppData\Roaming\Windows Update.exe"'
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4500
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.bat""
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3668
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:3204
            • C:\Users\Admin\AppData\Roaming\Windows Update.exe
              "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:620
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vDKSLmXZAli.exe"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4104
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vDKSLmXZAli" /XML "C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp"
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3260
              • C:\Users\Admin\AppData\Roaming\Windows Update.exe
                "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ucopa.exe.log
    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    b33fcc472b6b5f0a74be9ea18de4bf7d

    SHA1

    de49ad1f848998484a347e5d5695752f1189ff4a

    SHA256

    a5027aac97d4276d92c9f82b6630da0e155145b7fa059be43a65f86d177d1154

    SHA512

    31757728f1e9fbc9c5b79f61b3a8646378dfa38d18f816ba85a3fe4e42389ee60b90528024bc76a55e636a415b4d3062c4ed53abe5a153e50a94ef6edc30c3c8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Ucopa.exe
    Filesize

    613KB

    MD5

    3a581f3b380d9e4f8ad2eb3962398b90

    SHA1

    c1842a583d793972040d03a4901b0b63f0e97d65

    SHA256

    7ac3a47cb8196aae573d5855ce43ac0498f18281e4b9ff626f53eaf220c1fdc5

    SHA512

    7b03db127ccb8d1f98f465a52a82187cdb12ce17b651353db25a29d59e37cc1119aa9454d05a04853e5d0ffbbdba45833a10ea6e08e10b13878f7f5b7acb3a2e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzmwj5tt.jdh.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\adobe.js
    Filesize

    305KB

    MD5

    98d77a83c389bb812e0838c391b73258

    SHA1

    f543f656670ab8abfc78b06d8331b4c4a70c3df2

    SHA256

    177fa36898fbdb539116997091efff95984ccbd64a8a2b022f0557424a6fd915

    SHA512

    5f0bdc882df3a6eb86645d765b5c7d320c62ac278e8bee43e11742236dc60d1209ee7be50e7540ac94f710ab46280f5e5b46f8913d30a23c25b1403de4842ea8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svchost.js
    Filesize

    839KB

    MD5

    198a3620008e85b96e716688e6c9f8bb

    SHA1

    e61d0552a7aa2b4815e21fd955e335679af56d5e

    SHA256

    a28853b5fb6657f6491856b90e64381c197a3f7aa40a0a09199a5e9d61502bd3

    SHA512

    fa3d09906173ea98277266366daf5b47c9d44387b83fda3a1ec5a1ef6dda08b20f2b6344b6138421a0b98f16e44e0b147280ef490d9902ddfdca1268590cfbbc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp1364.tmp
    Filesize

    1KB

    MD5

    c97e107f48f25ff6e58b731ab62b9443

    SHA1

    ef3e645e8c87d685499476249a8a739c58b954b3

    SHA256

    14452927e3f0ec21efe6eba7fabe485f5cf36a7bd0513ce440e9089aba4af772

    SHA512

    903bc20d9e638a27306a123f5340742a1f4339b56fb2b8cdbdd40cba0ef3c645eae94af8b5d38919e951498e3d0f372c43fd02be9f1c5a8d5deb799f99defb29

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.bat
    Filesize

    158B

    MD5

    ccbac148320449e5b7f2d3c5a95ceaba

    SHA1

    eadd318e7564770145e8a1f9c7cace175a6566e2

    SHA256

    81649a3c0a939d48e407aa8010a3848ee932263c627af3f5009d7bf566b118ad

    SHA512

    0cd4f7b3448b1476691455b7c1ded3449ae92da6067a1b373f77eddb7e1a65404bf12e0a79a6eab11156da05a14a2769ac67f663f8c7efc1db90c79800627fd0

    Download Submit

  • memory/1968-26-0x0000000005580000-0x0000000005B24000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1968-33-0x00000000066E0000-0x0000000006736000-memory.dmp

    Filesize

    344KB

    Download

  • memory/1968-30-0x0000000005400000-0x000000000541C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1968-29-0x0000000005320000-0x00000000053BC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1968-28-0x0000000005250000-0x000000000525A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1968-27-0x00000000050B0000-0x0000000005142000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1968-25-0x0000000000620000-0x00000000006BC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2876-64-0x0000000006780000-0x00000000067CC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2876-83-0x0000000007C10000-0x0000000007C21000-memory.dmp

    Filesize

    68KB

    Download

  • memory/2876-61-0x00000000060B0000-0x0000000006404000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2876-63-0x00000000066F0000-0x000000000670E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2876-52-0x0000000005DC0000-0x0000000005E26000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2876-65-0x00000000076A0000-0x00000000076D2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2876-66-0x00000000713F0000-0x000000007143C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2876-76-0x0000000006C90000-0x0000000006CAE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2876-77-0x00000000078E0000-0x0000000007983000-memory.dmp

    Filesize

    652KB

    Download

  • memory/2876-78-0x0000000008060000-0x00000000086DA000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2876-79-0x0000000007A10000-0x0000000007A2A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2876-80-0x0000000007A90000-0x0000000007A9A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2876-82-0x0000000007C90000-0x0000000007D26000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2876-50-0x0000000005610000-0x0000000005632000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2876-84-0x0000000007C40000-0x0000000007C4E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2876-85-0x0000000007C50000-0x0000000007C64000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2876-86-0x0000000007D50000-0x0000000007D6A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2876-87-0x0000000007D30000-0x0000000007D38000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2876-51-0x00000000056B0000-0x0000000005716000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2876-40-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/2876-42-0x0000000005790000-0x0000000005DB8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2940-47-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/4104-119-0x00000000061B0000-0x00000000061FC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4104-120-0x0000000071A50000-0x0000000071A9C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4104-130-0x00000000071C0000-0x00000000071D1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/4104-131-0x0000000007200000-0x0000000007214000-memory.dmp

    Filesize

    80KB

    Download