eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
In August 2024, eSentire’s Threat Response Unit (TRU) observed an infection involving AsyncRAT stemming from the execution of a Windows Script File delivered via email. Although we could not retrieve the original email, we assess with high confidence that the malicious archive containing the payload was attached to it.
The payload is a .wsf file which uses a naming scheme that begins with “SummaryForm_” (MD5: 154cc0f462c85b494a45b7531f3a9f03). The file contains HTML character entities, as shown in Figure 1.
Figure 1: HTML character entities found in the malicious wsf file
The .wsf file fetches the VBScript (Figure 2) masquerading as a text file at hxxp://104.243.37[.]35:222/bfbupdeuiterborm/uzopuzbkrpcziwca.txt (MD5: a332817fd302e05b131c7a7a0cdb1a04).
Figure 2: Cleaned-up .WSF file
The VBScript does the following:
Uses Start-BitsTransfer to download a file from hxxp:// 104.243.37[.]35:222/bfbupdeuiterborm/lAOdPuUqwXLVFvqT.jpg. A file masquerading as an image file lAOdPuUqwXLVFvqT.jpg (MD5: c86280bd532eec707f106542a4458400) is then saved as bktpnecuahtazdbo.zip under the C:\Users\Public\ directory.
Uses Expand-Archive to extract the contents of the downloaded ZIP file into the C:\Users\Public\ directory.
Executes the VBScript file named IRUAHCKDFAFDCHUV.vbs located in the C:\Users\Public\ directory.
Deletes the bktpnecuahtazdbo.zip file to clean up traces of the initial download.
The VBS script IRUAHCKDFAFDCHUV.vbs (MD5: 1eefdb23f7c63922756eafb532127b8e) is responsible for executing the batch file CEIULUDEZFCEVSMM.bat (MD5: ac0f2aa2c5caf791f0310c2c07a1e1c3). The VBS script is also responsible for executing a PowerShell script at “C:\Users\Public\YXRPNPSMGCOBEURV.ps1” in a hidden window and bypassing execution policies.
Figure 3: Content CEIULUDEZFCEVSMM.bat
The PowerShell script YXRPNPSMGCOBEURV.ps1 (MD5: 315bc30cd580b750b4afc294fa38a8bc) creates a scheduled task named “MicrosoftEdgeUpdate500” on a Windows system using the Task Scheduler COM API. This task is created to run a VBS script located at C:\Users\Public\WCQCMXNSFCHWESFW.vbs every 2 minutes starting from the current time. The WCQCMXNSFCHWESFW.vbs script executed the batch file “C:\Users\Public\WJVIQQFZMZLSZTJJ.bat” (MD5: ec348cf15e839b8912862352bc916d22).
Figure 4: Content of YXRPNPSMGCOBEURV.ps1
The batch file WJVIQQFZMZLSZTJJ.bat is similar to CEIULUDEZFCEVSMM.bat, but it executes the NBUBMHCZJLEJXGVW.ps1 PowerShell script instead.
The first embedded binary “NewPE2.dll” (MD5: dcce5bc3e27295a1cbe13a411244fe93) in the script is the injector for the AsyncRAT payload. Specifically, it performs process hollowing on the RegAsm.exe process.
The strings referencing the APIs used for process injection are obfuscated by replacing specified placeholders with binary digits, reversing the order, filtering out non-binary characters, and then interpreting them as ASCII characters (Figure 5).
Figure 5: String obfuscation
You can find the configuration for AsyncRAT here. This version of AsyncRAT also comes with the infostealer plugin. The RAT looks for the following browsers to exfiltrate the data from:
Opera
OperaGX
Firefox
Chrome
Brave
Firefox
Edge
And the following cryptowallet browser extensions:
In conclusion, email continues to be a popular method for delivering malware, as shown in this case involving AsyncRAT infection, which not only facilitates remote access but also features information-stealing capabilities.
What did we do?
Our team of 24/7 SOC Cyber Analysts isolated the affected host to contain the infection, remediated the threat, and returned the host to service.
What can you learn from this TRU Positive?
The initial vector for the AsyncRAT infection was a phishing email, showcasing that this method still remains an effective way for attackers to deliver malware.
AsyncRAT provides attackers with remote access capabilities and includes an info stealer plugin. The plugin targets various browsers and cryptocurrency wallet extensions.
Recommendations from the Threat Response Unit (TRU):
We recommend modifying the default 'open-with' settings for script files to ensure they open with a basic text editor like Notepad instead of executing.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
