asyncrat | c69b81e6499b64d01ed7b231985f9061e8553309cbd64b00d1699e71d58fd4c3

Analysis

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Testing FR.exe
Size 48KB
Sample230321-c5xp6sae51
SHA256 c69b81e6499b64d01ed7b231985f9061e8553309cbd64b00d1699e71d58fd4c3
MD5 0c2353b8b6923a16f523944d6514bb8f
SHA1 d66baa60bcfbc057466b3ca0ef3076c5fd02210b
SHA512 857a0dbf2cd41349d72df6a68ad4743bd1d0b2cbdf245be4e3abda10e0323678beb5d0b78ebd968db751a3de58b924e792f64cc6ca1e7b0f27b42869179c979d
SSDEEP 768:OV9TQo2oIL4+M0+Li4ciiyYb1ge6eez+/vEgK/J8AmVc6KN:OVpQoVsbRbSlnz+/nkJ8AmVclN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:8809
thebest39393.ddns.net:8809

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Microsoft Services.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1388-54-0x0000000000AF0000-0x0000000000B02000-memory.dmp	asyncrat
behavioral1/files/0x000b0000000122e8-66.dat	asyncrat
behavioral1/files/0x000b0000000122e8-67.dat	asyncrat
behavioral1/memory/1756-68-0x00000000002D0000-0x00000000002E2000-memory.dmp	asyncrat
behavioral1/memory/1756-69-0x000000001AF50000-0x000000001AFD0000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1756	Microsoft Services.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1924	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
472	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1388	Testing FR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	Testing FR.exe
Token: SeDebugPrivilege	1756	Microsoft Services.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 916	1388	Testing FR.exe	28
PID 1388 wrote to memory of 916	1388	Testing FR.exe	28
PID 1388 wrote to memory of 916	1388	Testing FR.exe	28
PID 1388 wrote to memory of 1928	1388	Testing FR.exe	30
PID 1388 wrote to memory of 1928	1388	Testing FR.exe	30
PID 1388 wrote to memory of 1928	1388	Testing FR.exe	30
PID 916 wrote to memory of 1924	916	cmd.exe	33
PID 916 wrote to memory of 1924	916	cmd.exe	33
PID 916 wrote to memory of 1924	916	cmd.exe	33
PID 1928 wrote to memory of 472	1928	cmd.exe	32
PID 1928 wrote to memory of 472	1928	cmd.exe	32
PID 1928 wrote to memory of 472	1928	cmd.exe	32
PID 1928 wrote to memory of 1756	1928	cmd.exe	34
PID 1928 wrote to memory of 1756	1928	cmd.exe	34
PID 1928 wrote to memory of 1756	1928	cmd.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Testing FR.exe
"C:\Users\Admin\AppData\Local\Temp\Testing FR.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Services" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Services.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Services" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Services.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1924
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:472
- - C:\Users\Admin\AppData\Roaming\Microsoft Services.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft Services.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp1BDB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp.bat
Size 162B
SHA256 f1a87a1dad274a575804bc2a9e56ea0595ac2f7c560e361ddd051c2cd15a2b98
MD5 4959e505a839493f0bbe8358195f0c72
SHA1 79d8f3ddf4dcac2c13dc4d9798e517c56bcf0cf3
SHA512 be6c46ff0a1cc07f2bf4a569495cfbd8788e5f0b2414cd0416e1a62ceae3d3391598cf5972aba144efd488595700a46b7c866c8ef70db2ab79bf920acda67e89
MD5 SHA1 SHA512

Submit Download

tmp1BDB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp.bat
Size 162B
SHA256 f1a87a1dad274a575804bc2a9e56ea0595ac2f7c560e361ddd051c2cd15a2b98
MD5 4959e505a839493f0bbe8358195f0c72
SHA1 79d8f3ddf4dcac2c13dc4d9798e517c56bcf0cf3
SHA512 be6c46ff0a1cc07f2bf4a569495cfbd8788e5f0b2414cd0416e1a62ceae3d3391598cf5972aba144efd488595700a46b7c866c8ef70db2ab79bf920acda67e89
MD5 SHA1 SHA512

Submit Download

Microsoft Services.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft Services.exe
Size 48KB
SHA256 c69b81e6499b64d01ed7b231985f9061e8553309cbd64b00d1699e71d58fd4c3
MD5 0c2353b8b6923a16f523944d6514bb8f
SHA1 d66baa60bcfbc057466b3ca0ef3076c5fd02210b
SHA512 857a0dbf2cd41349d72df6a68ad4743bd1d0b2cbdf245be4e3abda10e0323678beb5d0b78ebd968db751a3de58b924e792f64cc6ca1e7b0f27b42869179c979d
SSDEEP 768:OV9TQo2oIL4+M0+Li4ciiyYb1ge6eez+/vEgK/J8AmVc6KN:OVpQoVsbRbSlnz+/nkJ8AmVclN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Services.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft Services.exe
Size 48KB
SHA256 c69b81e6499b64d01ed7b231985f9061e8553309cbd64b00d1699e71d58fd4c3
MD5 0c2353b8b6923a16f523944d6514bb8f
SHA1 d66baa60bcfbc057466b3ca0ef3076c5fd02210b
SHA512 857a0dbf2cd41349d72df6a68ad4743bd1d0b2cbdf245be4e3abda10e0323678beb5d0b78ebd968db751a3de58b924e792f64cc6ca1e7b0f27b42869179c979d
SSDEEP 768:OV9TQo2oIL4+M0+Li4ciiyYb1ge6eez+/vEgK/J8AmVc6KN:OVpQoVsbRbSlnz+/nkJ8AmVclN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-54-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Download

memory/1388-55-0x000000001B1B0000-0x000000001B230000-memory.dmp

Download

memory/1756-68-0x00000000002D0000-0x00000000002E2000-memory.dmp

Download

memory/1756-69-0x000000001AF50000-0x000000001AFD0000-memory.dmp

Download

memory/1756-70-0x000000001AF50000-0x000000001AFD0000-memory.dmp

Download