asyncrat | 79a7614b6d8ce75486f3b2a9b6c040b4a81ddb388190beb48fa01f5d6d229887

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79a7614b6d8ce75486f3b2a9b6c040b4a81ddb388190beb48fa01f5d6d229887.vbs
Size

301KB
MD5

c30ac201e015a9c7d486540e635bbc2f
SHA1

de6a7085adab35a08726a23b0aad3822f1e60cd6
SHA256

79a7614b6d8ce75486f3b2a9b6c040b4a81ddb388190beb48fa01f5d6d229887
SHA512

7d5fa7fc51a495fb6f99cc143516116c8e325183e5c0db66db75fb83fa7c6e3e8210b68231129ec05f235c3df20706f0ee5fe25875cfa8c2f8de9d7a431afe2f

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe	asyncrat
behavioral2/memory/3648-133-0x0000000000400000-0x000000000043C000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

AsyncClient.exe_protected.exe

pid process

3648 AsyncClient.exe_protected.exe

pid	process
3648	AsyncClient.exe_protected.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1916 wrote to memory of 3648	1916	WScript.exe	AsyncClient.exe_protected.exe
PID 1916 wrote to memory of 3648	1916	WScript.exe	AsyncClient.exe_protected.exe
PID 1916 wrote to memory of 3648	1916	WScript.exe	AsyncClient.exe_protected.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79a7614b6d8ce75486f3b2a9b6c040b4a81ddb388190beb48fa01f5d6d229887.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe"
2⤵
- Executes dropped EXE
PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe
Filesize
211KB

MD5
1f7b561d2fc8f56a52fe4ecf74314aa0

SHA1
c395685cb58226eb50713468d9f72b4f5d222f24

SHA256
cee659dd0e7ddacb9cf49bdba55f6c3be634e7134d058a441423bdc28c98e563

SHA512
3281e2ba76453bce5bfa48c166e3dd1fff47fab2274f30be67c21d3eee167638485b0df127bd2d63b01bb7bae5449dde2996a50e33a3b374cfc7f5ecca1eb4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe_protected.exe
Filesize
211KB

MD5
1f7b561d2fc8f56a52fe4ecf74314aa0

SHA1
c395685cb58226eb50713468d9f72b4f5d222f24

SHA256
cee659dd0e7ddacb9cf49bdba55f6c3be634e7134d058a441423bdc28c98e563

SHA512
3281e2ba76453bce5bfa48c166e3dd1fff47fab2274f30be67c21d3eee167638485b0df127bd2d63b01bb7bae5449dde2996a50e33a3b374cfc7f5ecca1eb4fa

Download Submit
memory/3648-130-0x0000000000000000-mapping.dmp

Download
memory/3648-133-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download