asyncrat | fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607

General

Target

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
Size

390KB
MD5

2777f662fe6d094fb8726aae2a6b39a6
SHA1

a643a95a7f45a612f45c4d398630b8b641b49bb7
SHA256

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607
SHA512

d2974a64b8a780f099f5bc67d03a7d90a8824f01b12be7f3c1803c7b68772c2b1622b3864578d2fa4e636a1154ff22f1a1f821a2330bca5daa99591e962ab23e

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Executes dropped EXE 3 IoCs

Processes:

Microsoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXEMicrosoft Windows Search Protocol Host.EXE

pid	process
1652	Microsoft Network Realtime Inspection Service.EXE
2184	Microsoft Windows Search Protocol Host.EXE
4884	Microsoft Windows Search Protocol Host.EXE

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exeMicrosoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Microsoft Windows Search Protocol Host.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Microsoft Network Realtime Inspection Service.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Microsoft Windows Search Protocol Host.EXE

Drops startup file 5 IoCs

Processes:

Microsoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE	Microsoft Windows Search Protocol Host.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Network Realtime Inspection Service.EXE	Microsoft Network Realtime Inspection Service.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Network Realtime Inspection Service.EXE	Microsoft Network Realtime Inspection Service.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE	Microsoft Windows Search Protocol Host.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE	Microsoft Windows Search Protocol Host.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5020 schtasks.exe
516 schtasks.exe
2492 schtasks.exe

pid	process
5020	schtasks.exe
516	schtasks.exe
2492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Microsoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

pid	process
2184	Microsoft Windows Search Protocol Host.EXE
2184	Microsoft Windows Search Protocol Host.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
2184	Microsoft Windows Search Protocol Host.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
2184	Microsoft Windows Search Protocol Host.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
2184	Microsoft Windows Search Protocol Host.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
2184	Microsoft Windows Search Protocol Host.EXE
4884	Microsoft Windows Search Protocol Host.EXE
4884	Microsoft Windows Search Protocol Host.EXE
2184	Microsoft Windows Search Protocol Host.EXE
2184	Microsoft Windows Search Protocol Host.EXE
1652	Microsoft Network Realtime Inspection Service.EXE
1652	Microsoft Network Realtime Inspection Service.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Microsoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	pid	process
Token: SeDebugPrivilege	2184	Microsoft Windows Search Protocol Host.EXE
Token: 33	2184	Microsoft Windows Search Protocol Host.EXE
Token: SeIncBasePriorityPrivilege	2184	Microsoft Windows Search Protocol Host.EXE
Token: SeDebugPrivilege	1652	Microsoft Network Realtime Inspection Service.EXE
Token: 33	1652	Microsoft Network Realtime Inspection Service.EXE
Token: SeIncBasePriorityPrivilege	1652	Microsoft Network Realtime Inspection Service.EXE
Token: SeDebugPrivilege	4884	Microsoft Windows Search Protocol Host.EXE
Token: 33	4884	Microsoft Windows Search Protocol Host.EXE
Token: SeIncBasePriorityPrivilege	4884	Microsoft Windows Search Protocol Host.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exeMicrosoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	pid	process	target process
PID 4612 wrote to memory of 1652	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 4612 wrote to memory of 1652	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 4612 wrote to memory of 1652	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 4612 wrote to memory of 2184	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 4612 wrote to memory of 2184	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 4612 wrote to memory of 2184	4612	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 2184 wrote to memory of 5020	2184	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 2184 wrote to memory of 5020	2184	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 2184 wrote to memory of 5020	2184	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 1652 wrote to memory of 516	1652	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1652 wrote to memory of 516	1652	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1652 wrote to memory of 516	1652	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 4884 wrote to memory of 2492	4884	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 4884 wrote to memory of 2492	4884	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 4884 wrote to memory of 2492	4884	Microsoft Windows Search Protocol Host.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
"C:\Users\Admin\AppData\Local\Temp\fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE
"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Network Realtime Inspection Service.EXE"
3⤵
- Creates scheduled task(s)
PID:516

C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE
"C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Windows Search Protocol Host.EXE"
3⤵
- Creates scheduled task(s)
PID:5020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Windows Search Protocol Host.EXE"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Windows Search Protocol Host.EXE"
2⤵
- Creates scheduled task(s)
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
memory/516-144-0x0000000000000000-mapping.dmp

Download
memory/1652-141-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/1652-142-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/1652-133-0x0000000000000000-mapping.dmp

Download
memory/2184-136-0x0000000000000000-mapping.dmp

Download
memory/2184-139-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download
memory/2184-140-0x0000000004D70000-0x0000000004E0C000-memory.dmp

Filesize
624KB

Download
memory/2184-147-0x0000000002779000-0x000000000277F000-memory.dmp

Filesize
24KB

Download
memory/2492-148-0x0000000000000000-mapping.dmp

Download
memory/5020-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads