Analysis
-
max time kernel
419s -
max time network
304s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 00:37
Static task
static1
Behavioral task
behavioral1
Sample
test.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
300 seconds
General
-
Target
test.vbs
-
Size
633B
-
MD5
8442b0a561a39e4d82b56835c5b666ef
-
SHA1
f1e116a9e31e0b5e66be020bb75d0cd40d3a9840
-
SHA256
e91990a5e2167c5d030656420a5cc77e10af179c43243da11a99e4286b0dcec3
-
SHA512
c26b3785aba0147e166632023c83c6568811c9d74f5747a78f772f3b891faedc0731abcf29cda634cde265f8bb8699fccad775eff3b45f76c0c3a29fa694570c
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
GDFjbxc9as
Mutex
Gx0edRwRzsDs0gzwQ
Attributes
-
delay
1
-
install
true
-
install_file
GoogleUpdates.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/QLnQD5yh
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000023c82-28.dat family_asyncrat -
Blocklisted process makes network request 7 IoCs
flow pid Process 2 3448 WScript.exe 6 3448 WScript.exe 9 3448 WScript.exe 11 3448 WScript.exe 15 3448 WScript.exe 19 3448 WScript.exe 20 3448 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Stub.exe -
Executes dropped EXE 2 IoCs
pid Process 2860 Stub.exe 4496 Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 raw.githubusercontent.com 19 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stub.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2456 taskmgr.exe Token: SeSystemProfilePrivilege 2456 taskmgr.exe Token: SeCreateGlobalPrivilege 2456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3448 wrote to memory of 2860 3448 WScript.exe 84 PID 3448 wrote to memory of 2860 3448 WScript.exe 84 PID 3448 wrote to memory of 2860 3448 WScript.exe 84 PID 2860 wrote to memory of 4496 2860 Stub.exe 86 PID 2860 wrote to memory of 4496 2860 Stub.exe 86
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"3⤵
- Executes dropped EXE
PID:4496
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD53d5d9fcc50f0ee536db107a2bb181f2d
SHA15b05d924177a9adf852abefa4d0afa77082b8370
SHA256febd0d25c9dcea243c4cd39dbf90178d970fbfd6305555291176aaa86bcfb391
SHA512143f6ff7522c798802da4dce511a671a2f43ee2c1368a1bfb8455f181956bcb97e89bfe42a21b1b4d21814bea92fdbdfd423cdef5d6540f447da4a84d521ffb6
-
Filesize
103KB
MD502075363168c82697c7726c175740b6e
SHA10adf648a0c0eb63cfa5dc2057feab117bc8ea0cd
SHA256733abf5dda85c41d1ce08b60175da38c3b84fac864ad0c06e225530ac30332e1
SHA512d381292bac696d0f95682264ce144e13f31bbe4d0dc34b5c277874278155768824c2bf14904f297e3aa9a321dd6790084129cb6c9e91d05ca318ee0d75e36094