Analysis

  • max time kernel
    136s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 14:20

General

  • Target

    PureRcs Adv Token Grabber‮nls..scr

  • Size

    3.0MB

  • MD5

    29ee9836013142f0f63c6813944c7021

  • SHA1

    90781c0a4d3fe85d1582eb1ca4c5aa910ee85b78

  • SHA256

    7382071535d0b83a8ee62e72c29e8f42d433b29238c4c86cfba7c4de4d6ad6b1

  • SHA512

    482d95357c48dbe380b90980a626fc04446de10e83e31dfbe850de94942091b86f01b83c2efe4517b887b8c288b0689e64809f5ad174deca759eeb9594d2e47e

  • SSDEEP

    49152:oXWsTEkwghTKv4jysGUqgCoOtt1JKLBuhFapNyPn7MU4HcOL:oXFEkwghTKv4jysGUqgCxttiBmas7+8

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

MetaMask

C2

51.103.217.70:6677

Mutex

MetaMask

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Google Chrome

C2

51.103.217.70:8585

Mutex

Google Chrome

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Windows Defender

C2

51.103.217.70:8585

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PureRcs Adv Token Grabber‮nls..scr
    "C:\Users\Admin\AppData\Local\Temp\PureRcs Adv Token Grabber‮nls..scr" /S
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE
      "C:\Users\Admin\AppData\Local\Temp\EDGE.EXE"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE
        "C:\Users\Admin\AppData\Local\Temp\EDGE.EXE"
        3⤵
        • Executes dropped EXE
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE
        "C:\Users\Admin\AppData\Local\Temp\EDGE.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:760
    • C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE
      "C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Google Chrome';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Google Chrome' -Value '"C:\Users\Admin\AppData\Roaming\Google Chrome\Google Chrome.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3092
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1900
    • C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE
      "C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'MetaMask';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'MetaMask' -Value '"C:\Users\Admin\AppData\Roaming\MetaMask\MetaMask.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1484
    • C:\Users\Admin\AppData\Local\Temp\RUNING.EXE
      "C:\Users\Admin\AppData\Local\Temp\RUNING.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Runing';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Runing' -Value '"C:\Users\Admin\AppData\Roaming\Runing\Runing.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
          PID:4452
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          #cmd
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            4⤵
              PID:2516

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        fb1df442f2cee34456c6ed9064318559

        SHA1

        729e8f61f181b303d25e1f709399db242d82c6c2

        SHA256

        75207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79

        SHA512

        d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294

      • C:\Users\Admin\AppData\Local\Temp\EDGE.EXE

        Filesize

        2.6MB

        MD5

        7820977c8b4d71e342f1a9500c1c631d

        SHA1

        d7e474fbe898efce9d91fa0efe8d9c5819377ad8

        SHA256

        b7a375b496836bdb609b2ad063a8909dd3f35e045a6e75f951d3d7f5d224c945

        SHA512

        ec4060c357f2b690b93ae27e6b9662cb50ee4149964418d6fb957fc9f613909cc01fe50a133d737057ff540335dd6979f2cef383df534fef07c60ba0b2d10713

      • C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

        Filesize

        79KB

        MD5

        a19ec34df640568c43c292a89c383ee1

        SHA1

        23753f88ff613085e363fed6246a3b08a78bf1df

        SHA256

        9b4298ad3fef1f609e9c34fa9471fc2b76bd6f5542823b66ace638b8c2edb079

        SHA512

        735f633aa99b70b486b895421841c5b7dd88e475e8c7e120d9b4054fad0989a23c61c13519a10fca9b575ec92949f7475065af34983606f4ba551e82b76e3f91

      • C:\Users\Admin\AppData\Local\Temp\METAMASK.EXE

        Filesize

        79KB

        MD5

        fa838d62246223fa79f7a7358691584c

        SHA1

        23d6f3ae392937a6c28d2159cc816dc5ee96d82a

        SHA256

        24e0ae5106103bb66889229dd18b796f4923727093113ca289c7039189bda19c

        SHA512

        b9a2ad7eb1f415f492e68fab97b302cd56e6ac1f0f4523a46078b8fbd5d22ac2178b9d5968a0abe9fb3855ac33ef26421b760dbdfb962343cbd291fa6a2a4b8c

      • C:\Users\Admin\AppData\Local\Temp\RUNING.EXE

        Filesize

        189KB

        MD5

        31c7b3f88bae3c9072ceb9c78cef1281

        SHA1

        43a5bd5efc6d7d91ccd41041f4532ad7813c5a57

        SHA256

        9dd3d01dc695d1e89ee6b31df506edb50d986bfae0f9082f945d0d802901cc24

        SHA512

        a9273ef41c7f4677bd6c2d328bd47cc57219eb36c04d96acc10c4da16d3525183fe2ba08ff91a7067a50d8be5623240ca3d09fc645576b4b1dedd16277ebadf9

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fpxnjxp1.v2t.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/760-61-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1000-81-0x0000000005F70000-0x0000000005FD6000-memory.dmp

        Filesize

        408KB

      • memory/1000-152-0x0000000007C30000-0x0000000007C4A000-memory.dmp

        Filesize

        104KB

      • memory/1000-76-0x0000000005030000-0x0000000005066000-memory.dmp

        Filesize

        216KB

      • memory/1000-123-0x0000000007540000-0x000000000755E000-memory.dmp

        Filesize

        120KB

      • memory/1000-151-0x0000000007B30000-0x0000000007B44000-memory.dmp

        Filesize

        80KB

      • memory/1000-112-0x0000000007560000-0x0000000007592000-memory.dmp

        Filesize

        200KB

      • memory/1000-113-0x0000000074290000-0x00000000742DC000-memory.dmp

        Filesize

        304KB

      • memory/1484-65-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

      • memory/1700-49-0x0000000000560000-0x000000000057A000-memory.dmp

        Filesize

        104KB

      • memory/1700-70-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/1700-52-0x00000000052D0000-0x0000000005874000-memory.dmp

        Filesize

        5.6MB

      • memory/1700-51-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/1900-67-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

      • memory/2004-72-0x0000000000400000-0x0000000000432000-memory.dmp

        Filesize

        200KB

      • memory/2004-74-0x00000000027D0000-0x00000000027DA000-memory.dmp

        Filesize

        40KB

      • memory/2072-71-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/2072-48-0x0000000000E70000-0x0000000000E8A000-memory.dmp

        Filesize

        104KB

      • memory/2072-50-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/2776-134-0x0000000007070000-0x0000000007113000-memory.dmp

        Filesize

        652KB

      • memory/2776-146-0x00000000073A0000-0x00000000073BA000-memory.dmp

        Filesize

        104KB

      • memory/2776-78-0x00000000050C0000-0x00000000050E2000-memory.dmp

        Filesize

        136KB

      • memory/2776-154-0x0000000007700000-0x0000000007722000-memory.dmp

        Filesize

        136KB

      • memory/2776-109-0x0000000005A80000-0x0000000005DD4000-memory.dmp

        Filesize

        3.3MB

      • memory/2776-110-0x0000000006080000-0x000000000609E000-memory.dmp

        Filesize

        120KB

      • memory/2776-111-0x00000000060A0000-0x00000000060EC000-memory.dmp

        Filesize

        304KB

      • memory/2776-150-0x00000000075D0000-0x00000000075DE000-memory.dmp

        Filesize

        56KB

      • memory/2776-80-0x00000000059A0000-0x0000000005A06000-memory.dmp

        Filesize

        408KB

      • memory/2776-147-0x0000000007410000-0x000000000741A000-memory.dmp

        Filesize

        40KB

      • memory/2776-124-0x0000000074290000-0x00000000742DC000-memory.dmp

        Filesize

        304KB

      • memory/2776-145-0x00000000079E0000-0x000000000805A000-memory.dmp

        Filesize

        6.5MB

      • memory/3092-148-0x0000000007430000-0x00000000074C6000-memory.dmp

        Filesize

        600KB

      • memory/3092-135-0x0000000074290000-0x00000000742DC000-memory.dmp

        Filesize

        304KB

      • memory/3092-149-0x00000000073B0000-0x00000000073C1000-memory.dmp

        Filesize

        68KB

      • memory/3092-153-0x00000000074D0000-0x00000000074D8000-memory.dmp

        Filesize

        32KB

      • memory/3092-77-0x0000000004FC0000-0x00000000055E8000-memory.dmp

        Filesize

        6.2MB

      • memory/3648-55-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/3648-75-0x0000000073980000-0x0000000074130000-memory.dmp

        Filesize

        7.7MB

      • memory/3648-47-0x0000000000B10000-0x0000000000B46000-memory.dmp

        Filesize

        216KB

      • memory/4396-53-0x0000000000620000-0x00000000008BE000-memory.dmp

        Filesize

        2.6MB

      • memory/4396-57-0x0000000006060000-0x000000000609A000-memory.dmp

        Filesize

        232KB

      • memory/4396-54-0x0000000005140000-0x00000000051DC000-memory.dmp

        Filesize

        624KB

      • memory/4396-45-0x000000007398E000-0x000000007398F000-memory.dmp

        Filesize

        4KB