Analysis
- max time kernel
18s - max time network
18s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/12/2024, 04:31
General
- Target injection.exe
- Size 264KB
- Sample241227-e5v8fs1raz
- SHA256 7d739906ed3602a3617329cf9a8c314c4bf0cb898923e53137d6b25b2e3e4595
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
lfrlrahocljxyqyr
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/xFvrV0SD
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Async RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\injection.exe"C:\Users\Admin\AppData\Local\Temp\injection.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\SearchApp.exeC:\Users\Admin\AppData\Roaming\SearchApp.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bily15wj.ogo.ps1
SearchApp.exe
memory/2988-0-0x00007FFCD91D3000-0x00007FFCD91D5000-memory.dmp
memory/2988-1-0x0000000000EA0000-0x0000000000EE8000-memory.dmp
memory/2988-32-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2988-36-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2996-12-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2996-13-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2996-14-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2996-17-0x00007FFCD91D0000-0x00007FFCD9C91000-memory.dmp
memory/2996-8-0x000001B3B6C60000-0x000001B3B6C82000-memory.dmp
memory/4224-37-0x00000000023B0000-0x00000000023C8000-memory.dmp