asyncrat | b2cb01768dbbcaee4de2957e7f60bbc9b801f4f821224f89ef87948fd7c14bd4

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2022, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.7MB
Sample220830-xftx7sfbf3
SHA256 b2cb01768dbbcaee4de2957e7f60bbc9b801f4f821224f89ef87948fd7c14bd4
MD5 2a62bfcb257bc494d0d0da94c9e08b38
SHA1 2d3f85f45e4483f8d6a39a614d415110e574c6d2
SHA512 e5ae2a2298e21bb081be89a6cece55fbf16283eab15436541b345bfec115950bc91dc8e1f948550e2de775e09431aafbc9110325646e201f43d57b9ed29743ac
SSDEEP 49152:XM0jPObj7t1/znzLqlpWsUYZjHYqb01M0fg:XM0qTt5znzLMJzZjH2m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat smart audio rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Smart Audio

acronispandora.ddns.net:1604

Mutex

Smart Audio

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/396-151-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4040	DllHelper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 396	4040	DllHelper.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1828	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4176	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4500	file.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe
4040	DllHelper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1828	4500	file.exe	87
PID 4500 wrote to memory of 1828	4500	file.exe	87
PID 4500 wrote to memory of 1828	4500	file.exe	87
PID 4500 wrote to memory of 4040	4500	file.exe	89
PID 4500 wrote to memory of 4040	4500	file.exe	89
PID 4500 wrote to memory of 4040	4500	file.exe	89
PID 4500 wrote to memory of 1352	4500	file.exe	90
PID 4500 wrote to memory of 1352	4500	file.exe	90
PID 4500 wrote to memory of 1352	4500	file.exe	90
PID 1352 wrote to memory of 448	1352	cmd.exe	92
PID 1352 wrote to memory of 448	1352	cmd.exe	92
PID 1352 wrote to memory of 448	1352	cmd.exe	92
PID 1352 wrote to memory of 4176	1352	cmd.exe	93
PID 1352 wrote to memory of 4176	1352	cmd.exe	93
PID 1352 wrote to memory of 4176	1352	cmd.exe	93
PID 4040 wrote to memory of 396	4040	DllHelper.exe	97
PID 4040 wrote to memory of 396	4040	DllHelper.exe	97
PID 4040 wrote to memory of 396	4040	DllHelper.exe	97
PID 4040 wrote to memory of 396	4040	DllHelper.exe	97
PID 4040 wrote to memory of 396	4040	DllHelper.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1828
- C:\Users\Admin\AppVerif\DllHelper.exe
  "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:448
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DllHelper.exe

Path C:\Users\Admin\AppVerif\DllHelper.exe
Size 179.5MB
SHA256 97562e7ecb17bb4245c47f925ec2af7536a161e2997fead40a70030e87575ea2
MD5 bfa4b4ea6ed78dd83c6ced2b20d555cf
SHA1 0b26e1c6d6b90d35997377db8ddea87994f31079
SHA512 ad9a6049fa31e45b8b97b6da702b33a6f31afdc4d61a1e517f65565dbae8f9917ebd67637f35debf9deae0748278480fab4796892815235c3f471ce4afd62d99
SSDEEP 49152:XM0jPObj7t1/znzLqlpWsUYZjHYqb01M0f:XM0qTt5znzLMJzZjH2
MD5 SHA1 SHA512 SSDEEP

Submit Download

DllHelper.exe

Path C:\Users\Admin\AppVerif\DllHelper.exe
Size 177.2MB
SHA256 c4b2dc5abf141b36c3a893d8d65c0bbea0036925d22ffb4efcf0529f68d8edbd
MD5 2bd9f522139d822ad3262b8c6e2db621
SHA1 326a8cdc72b4fed3b5790579dc5876ba0e1f0e54
SHA512 4a8c0405b04ee881224713ee7117fda7ef6eac7908b754d7f4fade0893a2176f7a6d8ab8cdef412f4d5e013dfcf8e4cb7d70952e913a288f768f437a50fde8cd
SSDEEP 49152:XM0jPObj7t1/znzLqlpWsUYZjHYqb01M0f:XM0qTt5znzLMJzZjH2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-151-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/396-149-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4040-147-0x000000000CE90000-0x000000000CF62000-memory.dmp

Download

memory/4040-144-0x0000000002201000-0x00000000027D8000-memory.dmp

Download

memory/4040-145-0x000000000CE90000-0x000000000CF62000-memory.dmp

Download

memory/4040-146-0x00000000027E3000-0x0000000002954000-memory.dmp

Download

memory/4040-152-0x00000000027E3000-0x0000000002954000-memory.dmp

Download

memory/4500-142-0x0000000002A29000-0x0000000002B9A000-memory.dmp

Download

memory/4500-132-0x0000000002442000-0x0000000002A19000-memory.dmp

Download

memory/4500-135-0x0000000002A29000-0x0000000002B9A000-memory.dmp

Download

memory/4500-134-0x0000000002442000-0x0000000002A19000-memory.dmp

Download

memory/4500-133-0x0000000002A29000-0x0000000002B9A000-memory.dmp

Download