asyncrat | 1cc12f5a9abb33e222373fa27b4ef631abfbd9343a168b194ef8c958bee79abc

Analysis

max time kernel
139s
max time network
153s
platform
windows7_x64
resource
win7-20221111-es
resource tags

arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows
submitted
01/01/2023, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam Checker By abbadon/config/Config.bat
Size

264B
MD5

443439b6d74924824b35ee2fe65af7e7
SHA1

c94233394c85c86ea0f1d658a32e5ab27f60730f
SHA256

74d98354b2cf545581931fef42a42e8fc3298b236f6536cc31fa821f31b4e6da
SHA512

98b28b6546e3fd3fbf89895c21ff6b7d93568559433addc4be238825a11445a2496c90a872f10e0b316fdaf07ee0ccbf4054d7c5483456ecbda36154b879f1be

Score

10^/10

asyncrat c rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

185.81.157.169:2023

Mutex

7G6ZCBCA-NJ11-YS93-65bg-CX918E7238D5

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 7 IoCs

rat

resource	yara_rule
behavioral25/memory/1788-111-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral25/memory/1788-112-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral25/memory/1788-113-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral25/memory/1788-114-0x000000000040CBAE-mapping.dmp	asyncrat
behavioral25/memory/1788-116-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral25/memory/1788-118-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral25/memory/1140-130-0x000000000040CBAE-mapping.dmp	asyncrat

Executes dropped EXE 3 IoCs

pid	Process
2036	SystemUpdates.exe
1548	MicrosoftEdgeUpdates.exe
1716	SystemUpdates.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1788	2036	SystemUpdates.exe	40
PID 1716 set thread context of 1140	1716	SystemUpdates.exe	42

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1140	schtasks.exe
1144	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1548	MicrosoftEdgeUpdates.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1924	powershell.exe
1504	powershell.exe
1960	powershell.exe
1124	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1924	1692	cmd.exe	29
PID 1692 wrote to memory of 1924	1692	cmd.exe	29
PID 1692 wrote to memory of 1924	1692	cmd.exe	29
PID 1692 wrote to memory of 1504	1692	cmd.exe	30
PID 1692 wrote to memory of 1504	1692	cmd.exe	30
PID 1692 wrote to memory of 1504	1692	cmd.exe	30
PID 1692 wrote to memory of 1140	1692	cmd.exe	31
PID 1692 wrote to memory of 1140	1692	cmd.exe	31
PID 1692 wrote to memory of 1140	1692	cmd.exe	31
PID 1692 wrote to memory of 1144	1692	cmd.exe	32
PID 1692 wrote to memory of 1144	1692	cmd.exe	32
PID 1692 wrote to memory of 1144	1692	cmd.exe	32
PID 1692 wrote to memory of 1452	1692	cmd.exe	33
PID 1692 wrote to memory of 1452	1692	cmd.exe	33
PID 1692 wrote to memory of 1452	1692	cmd.exe	33
PID 1692 wrote to memory of 820	1692	cmd.exe	34
PID 1692 wrote to memory of 820	1692	cmd.exe	34
PID 1692 wrote to memory of 820	1692	cmd.exe	34
PID 1692 wrote to memory of 1960	1692	cmd.exe	35
PID 1692 wrote to memory of 1960	1692	cmd.exe	35
PID 1692 wrote to memory of 1960	1692	cmd.exe	35
PID 1692 wrote to memory of 1124	1692	cmd.exe	36
PID 1692 wrote to memory of 1124	1692	cmd.exe	36
PID 1692 wrote to memory of 1124	1692	cmd.exe	36
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 2036	284	taskeng.exe	38
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 284 wrote to memory of 1548	284	taskeng.exe	39
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 2036 wrote to memory of 1788	2036	SystemUpdates.exe	40
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 284 wrote to memory of 1716	284	taskeng.exe	41
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42
PID 1716 wrote to memory of 1140	1716	SystemUpdates.exe	42

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
820	attrib.exe
1452	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon\config\Config.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath "C:\Users" -force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "Microsoft\MicrosoftEdgeUpdates\EdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe" /RL HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1140
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "Microsoft\SystemUpdates\SysUpdate" /tr "C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe" /RL HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1144
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates
  2⤵
  - Views/modifies file attributes
  PID:1452
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\SystemUpdates
  2⤵
  - Views/modifies file attributes
  PID:820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File CopyTo.PS1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C2.PS1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124

C:\Windows\system32\taskeng.exe
taskeng.exe {B820CF15-A04E-4592-8D83-67FD4A5FBA9C} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:284
- C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1788
- C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe
  C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:1548
- C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe

Filesize
15KB

MD5
492bd942c673806c4dc7d076d44a06de

SHA1
ace44cc6d1f875aa1b58c2c0c51901f9c11b0221

SHA256
30e04b25281b27e83652be61a8a61821730e30be65a95452c3b93a7a17333f00

SHA512
8a328d28055337629823795dcc96adf1fce2dba6079ec29472b81f8b89917d6b312efc0ec566732effcbfa95ddf96848dead444900096ed71da590dd3861477f

Download Submit
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe

Filesize
15KB

MD5
492bd942c673806c4dc7d076d44a06de

SHA1
ace44cc6d1f875aa1b58c2c0c51901f9c11b0221

SHA256
30e04b25281b27e83652be61a8a61821730e30be65a95452c3b93a7a17333f00

SHA512
8a328d28055337629823795dcc96adf1fce2dba6079ec29472b81f8b89917d6b312efc0ec566732effcbfa95ddf96848dead444900096ed71da590dd3861477f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7d172571a5b9f521b5e6baced6fdbf84

SHA1
9687c81e5906ab2b0b5bf3475bc3cac251838dba

SHA256
59d68478b08bb04fb8855b8376d2d9cc2ca2b04bcfb0e3258a1e60a9e260aaed

SHA512
f1c3df2978a2197d0a56c4f5085ab853c191253cd990722c6b5f091b351ad936b470d16ed0675a2c708a0041ad9dbdc43bbcc2adc4468272ffc7114706ba4d1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7d172571a5b9f521b5e6baced6fdbf84

SHA1
9687c81e5906ab2b0b5bf3475bc3cac251838dba

SHA256
59d68478b08bb04fb8855b8376d2d9cc2ca2b04bcfb0e3258a1e60a9e260aaed

SHA512
f1c3df2978a2197d0a56c4f5085ab853c191253cd990722c6b5f091b351ad936b470d16ed0675a2c708a0041ad9dbdc43bbcc2adc4468272ffc7114706ba4d1a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7d172571a5b9f521b5e6baced6fdbf84

SHA1
9687c81e5906ab2b0b5bf3475bc3cac251838dba

SHA256
59d68478b08bb04fb8855b8376d2d9cc2ca2b04bcfb0e3258a1e60a9e260aaed

SHA512
f1c3df2978a2197d0a56c4f5085ab853c191253cd990722c6b5f091b351ad936b470d16ed0675a2c708a0041ad9dbdc43bbcc2adc4468272ffc7114706ba4d1a

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
memory/1124-92-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1124-91-0x00000000025E4000-0x00000000025E7000-memory.dmp

Filesize
12KB

Download
memory/1124-90-0x000007FEF2FF0000-0x000007FEF3B4D000-memory.dmp

Filesize
11.4MB

Download
memory/1124-89-0x000007FEF3B50000-0x000007FEF4573000-memory.dmp

Filesize
10.1MB

Download
memory/1124-93-0x00000000025E4000-0x00000000025E7000-memory.dmp

Filesize
12KB

Download
memory/1124-94-0x00000000025EB000-0x000000000260A000-memory.dmp

Filesize
124KB

Download
memory/1504-69-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/1504-70-0x00000000026EB000-0x000000000270A000-memory.dmp

Filesize
124KB

Download
memory/1504-65-0x000007FEF3B50000-0x000007FEF4573000-memory.dmp

Filesize
10.1MB

Download
memory/1504-66-0x000007FEF2FF0000-0x000007FEF3B4D000-memory.dmp

Filesize
11.4MB

Download
memory/1504-67-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/1504-68-0x000000001B770000-0x000000001BA6F000-memory.dmp

Filesize
3.0MB

Download
memory/1548-101-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/1548-103-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1716-135-0x0000000004845000-0x0000000004856000-memory.dmp

Filesize
68KB

Download
memory/1716-122-0x0000000000FD0000-0x0000000001012000-memory.dmp

Filesize
264KB

Download
memory/1788-116-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-112-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-109-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-108-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1788-118-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-61-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/1924-59-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1924-55-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/1924-57-0x000007FEF1AD0000-0x000007FEF262D000-memory.dmp

Filesize
11.4MB

Download
memory/1924-56-0x000007FEF31B0000-0x000007FEF3BD3000-memory.dmp

Filesize
10.1MB

Download
memory/1924-58-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1924-60-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1960-85-0x000000000240B000-0x000000000242A000-memory.dmp

Filesize
124KB

Download
memory/1960-79-0x000007FEF31B0000-0x000007FEF3BD3000-memory.dmp

Filesize
10.1MB

Download
memory/1960-80-0x000007FEF1AD0000-0x000007FEF262D000-memory.dmp

Filesize
11.4MB

Download
memory/1960-81-0x000000001B7E0000-0x000000001BADF000-memory.dmp

Filesize
3.0MB

Download
memory/1960-83-0x000000000240B000-0x000000000242A000-memory.dmp

Filesize
124KB

Download
memory/1960-82-0x0000000002404000-0x0000000002407000-memory.dmp

Filesize
12KB

Download
memory/1960-84-0x0000000002404000-0x0000000002407000-memory.dmp

Filesize
12KB

Download
memory/2036-107-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/2036-106-0x00000000004B0000-0x00000000004F0000-memory.dmp

Filesize
256KB

Download
memory/2036-105-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/2036-102-0x0000000000ED0000-0x0000000000F12000-memory.dmp

Filesize
264KB

Download