asyncrat | 82dbd2c8c85902531ba683ae097c42a567a503054bbea2292e4741935018d7d4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.ps1
Size

257KB
MD5

fa9de551f6fd38a4b04e3207e08e846c
SHA1

2ef8eb4e82ce9f52e5fa61e04fec1f9b92230903
SHA256

f8dae9c1f9c629a6811c6b2fc648b8f952a0331a1d5c04005808b4daeeae93fb
SHA512

ed8024a8279f3ac1a4d4b3be7214b9ec0d429a7228ea126e298034c4952e0ce048f7c83d4e0aab0760701653a0a77aea82cd94ae5b59161cae811a93c212c3ce
SSDEEP

6144:JRQRmeIR/ENCsOFAjL3vTV8MG0NsPSSzQw6ACnfRFG5jS:zXiL7XvLw6Ak6W

Score

10^/10

asyncrat 29/7 discovery execution persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

29/7

vvat22.con-ip.com:7707

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	4616	pOwErshEll.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
4724	powershell.exe
3908	powershell.exe
2748	pOwErshEll.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 2440	2912	powershell.exe	95

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2604	reg.exe
2744	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4724	powershell.exe
4724	powershell.exe
3908	powershell.exe
3908	powershell.exe
2748	pOwErshEll.exe
2748	pOwErshEll.exe
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeIncreaseQuotaPrivilege	3908	powershell.exe
Token: SeSecurityPrivilege	3908	powershell.exe
Token: SeTakeOwnershipPrivilege	3908	powershell.exe
Token: SeLoadDriverPrivilege	3908	powershell.exe
Token: SeSystemProfilePrivilege	3908	powershell.exe
Token: SeSystemtimePrivilege	3908	powershell.exe
Token: SeProfSingleProcessPrivilege	3908	powershell.exe
Token: SeIncBasePriorityPrivilege	3908	powershell.exe
Token: SeCreatePagefilePrivilege	3908	powershell.exe
Token: SeBackupPrivilege	3908	powershell.exe
Token: SeRestorePrivilege	3908	powershell.exe
Token: SeShutdownPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeSystemEnvironmentPrivilege	3908	powershell.exe
Token: SeRemoteShutdownPrivilege	3908	powershell.exe
Token: SeUndockPrivilege	3908	powershell.exe
Token: SeManageVolumePrivilege	3908	powershell.exe
Token: 33	3908	powershell.exe
Token: 34	3908	powershell.exe
Token: 35	3908	powershell.exe
Token: 36	3908	powershell.exe
Token: SeDebugPrivilege	2748	pOwErshEll.exe
Token: SeIncreaseQuotaPrivilege	3908	powershell.exe
Token: SeSecurityPrivilege	3908	powershell.exe
Token: SeTakeOwnershipPrivilege	3908	powershell.exe
Token: SeLoadDriverPrivilege	3908	powershell.exe
Token: SeSystemProfilePrivilege	3908	powershell.exe
Token: SeSystemtimePrivilege	3908	powershell.exe
Token: SeProfSingleProcessPrivilege	3908	powershell.exe
Token: SeIncBasePriorityPrivilege	3908	powershell.exe
Token: SeCreatePagefilePrivilege	3908	powershell.exe
Token: SeBackupPrivilege	3908	powershell.exe
Token: SeRestorePrivilege	3908	powershell.exe
Token: SeShutdownPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeSystemEnvironmentPrivilege	3908	powershell.exe
Token: SeRemoteShutdownPrivilege	3908	powershell.exe
Token: SeUndockPrivilege	3908	powershell.exe
Token: SeManageVolumePrivilege	3908	powershell.exe
Token: 33	3908	powershell.exe
Token: 34	3908	powershell.exe
Token: 35	3908	powershell.exe
Token: 36	3908	powershell.exe
Token: SeIncreaseQuotaPrivilege	3908	powershell.exe
Token: SeSecurityPrivilege	3908	powershell.exe
Token: SeTakeOwnershipPrivilege	3908	powershell.exe
Token: SeLoadDriverPrivilege	3908	powershell.exe
Token: SeSystemProfilePrivilege	3908	powershell.exe
Token: SeSystemtimePrivilege	3908	powershell.exe
Token: SeProfSingleProcessPrivilege	3908	powershell.exe
Token: SeIncBasePriorityPrivilege	3908	powershell.exe
Token: SeCreatePagefilePrivilege	3908	powershell.exe
Token: SeBackupPrivilege	3908	powershell.exe
Token: SeRestorePrivilege	3908	powershell.exe
Token: SeShutdownPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeSystemEnvironmentPrivilege	3908	powershell.exe
Token: SeRemoteShutdownPrivilege	3908	powershell.exe
Token: SeUndockPrivilege	3908	powershell.exe
Token: SeManageVolumePrivilege	3908	powershell.exe
Token: 33	3908	powershell.exe
Token: 34	3908	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3908	4724	powershell.exe	84
PID 4724 wrote to memory of 3908	4724	powershell.exe	84
PID 3908 wrote to memory of 2240	3908	powershell.exe	85
PID 3908 wrote to memory of 2240	3908	powershell.exe	85
PID 2748 wrote to memory of 3904	2748	pOwErshEll.exe	90
PID 2748 wrote to memory of 3904	2748	pOwErshEll.exe	90
PID 3904 wrote to memory of 2604	3904	cmd.exe	91
PID 3904 wrote to memory of 2604	3904	cmd.exe	91
PID 3904 wrote to memory of 2744	3904	cmd.exe	92
PID 3904 wrote to memory of 2744	3904	cmd.exe	92
PID 3904 wrote to memory of 1788	3904	cmd.exe	93
PID 3904 wrote to memory of 1788	3904	cmd.exe	93
PID 1788 wrote to memory of 2912	1788	cmd.exe	94
PID 1788 wrote to memory of 2912	1788	cmd.exe	94
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95
PID 2912 wrote to memory of 2440	2912	powershell.exe	95

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.vbs"
    3⤵
    PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\pOwErshEll.exe
pOwErshEll -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.bat
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2604
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2744
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\BOHRRCBYGXGIFDRSIXWFDC.ps1'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\BOHRRCBYGXGIFDRSIXWFDC.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\BOHRRCBYGXGIFDRSIXWFDC.ps1

Filesize
249KB

MD5
2a885e95eed0618751d77924d91343e8

SHA1
569268f7fcb9e4106811fa961abc343c06ae31f2

SHA256
7df6b8f4fd39e4503a96e5971a1d4a568f7e4d4ad789c8d822191a79f9453a6a

SHA512
5c439ae8deedf7a3339920c540c0a1b4d04c603978844553184c3db9fda4550888f94bfe7df0a89a00261795900a78f902a8a06ce7db0305551d268d2cbe64dc

Download Submit
C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.bat

Filesize
693B

MD5
fe1271b4137a989c4d9021e549a70d3d

SHA1
b70151e479298f4d70392d6b51e21c36fddc4374

SHA256
e1690ba66bce1265e73be22baf3b29ec96054f3a766698baac27202aede8abb6

SHA512
e933cfd3a510035664b849080aa2c2e1c12918b024a0ffef772563b518bc911f8c9bdca224ded560678519198ebfd3e06e5515e4c4aecd3617dc4c199f626ad7

Download Submit
C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.ps1

Filesize
3KB

MD5
339453f9cb54562220aba7f8fcae040c

SHA1
d868eefada015f4892a88e7205e09ddd9da647a4

SHA256
f5b34b456329ccdeeca89791a6807d270e2d805af5b11a24bb6c227635453a45

SHA512
75ae607f2bf4e677ef5a68882e6bae9aa3810044190191d008911dd1790f8a7f486f1ae686482d523b8e65bd2372451bebf63fe508c60a5afed74923e0e46b96

Download Submit
C:\ProgramData\ZVRWWLCFPWDOBNVCDRSFZL\ZVRWWLCFPWDOBNVCDRSFZL.vbs

Filesize
1KB

MD5
4d123e5a4ac35d53aa15d7d577807309

SHA1
d689facafa48e00f7882cc10cb8266e4c8359fc5

SHA256
556c63a874e38c562ff8e252aa1b4718c62692058005e56b69e04670ecee3a11

SHA512
06de0adae18cd2fcb8cebc4ec23fda28aa1b28d1a8c74d72bf7bb56ead29dc3736d486fbd3dd864a2c8b895a207a4c4f3f5cf1c1e7d825048a0a7d26d6106988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
00e7da020005370a518c26d5deb40691

SHA1
389b34fdb01997f1de74a5a2be0ff656280c0432

SHA256
a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe

SHA512
9a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d74f3420d97c3324b6032942f3a9fa7

SHA1
95af9f165ffc370c5d654a39d959a8c4231122b9

SHA256
8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

SHA512
3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1jqrnkf.aji.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2440-70-0x0000000001100000-0x0000000001112000-memory.dmp

Filesize
72KB

Download
memory/2440-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2912-64-0x000001906DE60000-0x000001906DE6C000-memory.dmp

Filesize
48KB

Download
memory/2912-65-0x000001906E1C0000-0x000001906E1DA000-memory.dmp

Filesize
104KB

Download
memory/3908-48-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3908-21-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3908-20-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3908-19-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4724-12-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4724-11-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4724-15-0x00007FFEC95C3000-0x00007FFEC95C5000-memory.dmp

Filesize
8KB

Download
memory/4724-0-0x00007FFEC95C3000-0x00007FFEC95C5000-memory.dmp

Filesize
8KB

Download
memory/4724-52-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1-0x0000026173D30000-0x0000026173D52000-memory.dmp

Filesize
136KB

Download
memory/4724-16-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download