Analysis
-
max time kernel
15s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 18:37
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20220812-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
7baa4836bd81113c16960501f679a81b
-
SHA1
007416f9ba10d2e2951a9dcd104b7206ad20d433
-
SHA256
094b57a07096fb1f866a104c0b14c84aa99815b613587780765c8c6cd6ef1a42
-
SHA512
988035fbecccadab900f3a6bf2936b5241fa197956286c135a3921370b153e4a12fced55c7cd1760889dd63f970f3b5c37c890aa9e45fbd6afa52934face1079
-
SSDEEP
768:bum8n1TQwtPtWUN01nmo2qzPKjGKG6PIyzjbFgX3irARm3OCkgCdqTHBDZ3x:bum81TQq426KYDy3bCXSrARmeCkgmqTB
Malware Config
Extracted
asyncrat
0.5.7B
Default
62.37.96.229:30120
192.168.1.114:30120
6SI8OkPnk
-
delay
3
-
install
true
-
install_file
RedEngine.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/808-132-0x0000000000160000-0x0000000000172000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\RedEngine.exe asyncrat C:\Users\Admin\AppData\Roaming\RedEngine.exe asyncrat -
Executes dropped EXE 1 IoCs
Processes:
RedEngine.exepid process 2812 RedEngine.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4156 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
AsyncClient.exepid process 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe 808 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exeRedEngine.exedescription pid process Token: SeDebugPrivilege 808 AsyncClient.exe Token: SeDebugPrivilege 2812 RedEngine.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
AsyncClient.execmd.execmd.exedescription pid process target process PID 808 wrote to memory of 4800 808 AsyncClient.exe cmd.exe PID 808 wrote to memory of 4800 808 AsyncClient.exe cmd.exe PID 808 wrote to memory of 4800 808 AsyncClient.exe cmd.exe PID 808 wrote to memory of 4988 808 AsyncClient.exe cmd.exe PID 808 wrote to memory of 4988 808 AsyncClient.exe cmd.exe PID 808 wrote to memory of 4988 808 AsyncClient.exe cmd.exe PID 4988 wrote to memory of 4156 4988 cmd.exe timeout.exe PID 4988 wrote to memory of 4156 4988 cmd.exe timeout.exe PID 4988 wrote to memory of 4156 4988 cmd.exe timeout.exe PID 4800 wrote to memory of 1508 4800 cmd.exe schtasks.exe PID 4800 wrote to memory of 1508 4800 cmd.exe schtasks.exe PID 4800 wrote to memory of 1508 4800 cmd.exe schtasks.exe PID 4988 wrote to memory of 2812 4988 cmd.exe RedEngine.exe PID 4988 wrote to memory of 2812 4988 cmd.exe RedEngine.exe PID 4988 wrote to memory of 2812 4988 cmd.exe RedEngine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RedEngine" /tr '"C:\Users\Admin\AppData\Roaming\RedEngine.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RedEngine" /tr '"C:\Users\Admin\AppData\Roaming\RedEngine.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7F37.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\RedEngine.exe"C:\Users\Admin\AppData\Roaming\RedEngine.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7F37.tmp.batFilesize
153B
MD5aec9a9bc74b93d33ed8056618ca45c25
SHA15bc16502d9446d57ad414d98b09a6f34da0774ae
SHA2568d3d6a957676e784704b7d49586a4add666c485402520b54c286a751dff27179
SHA512bbfe4b4acb7588e4c083726f02eed9165b1acb94ddc662e35aac2926c6a65fbd9539553bca20b6717b4925b3a90190bd195a98d62b46984f65ce25cb212bfd5d
-
C:\Users\Admin\AppData\Roaming\RedEngine.exeFilesize
45KB
MD57baa4836bd81113c16960501f679a81b
SHA1007416f9ba10d2e2951a9dcd104b7206ad20d433
SHA256094b57a07096fb1f866a104c0b14c84aa99815b613587780765c8c6cd6ef1a42
SHA512988035fbecccadab900f3a6bf2936b5241fa197956286c135a3921370b153e4a12fced55c7cd1760889dd63f970f3b5c37c890aa9e45fbd6afa52934face1079
-
C:\Users\Admin\AppData\Roaming\RedEngine.exeFilesize
45KB
MD57baa4836bd81113c16960501f679a81b
SHA1007416f9ba10d2e2951a9dcd104b7206ad20d433
SHA256094b57a07096fb1f866a104c0b14c84aa99815b613587780765c8c6cd6ef1a42
SHA512988035fbecccadab900f3a6bf2936b5241fa197956286c135a3921370b153e4a12fced55c7cd1760889dd63f970f3b5c37c890aa9e45fbd6afa52934face1079
-
memory/808-132-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/808-133-0x0000000004BE0000-0x0000000004C7C000-memory.dmpFilesize
624KB
-
memory/1508-138-0x0000000000000000-mapping.dmp
-
memory/2812-139-0x0000000000000000-mapping.dmp
-
memory/2812-142-0x00000000065E0000-0x0000000006B84000-memory.dmpFilesize
5.6MB
-
memory/2812-143-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/4156-137-0x0000000000000000-mapping.dmp
-
memory/4800-134-0x0000000000000000-mapping.dmp
-
memory/4988-135-0x0000000000000000-mapping.dmp