Overview
overview
10Static
static
10COMPILED.zip
windows10-2004-x64
1AsyncRAT v...AT.exe
windows10-2004-x64
10AsyncRAT v...xe.xml
windows10-2004-x64
1AsyncRAT v...er.bat
windows10-2004-x64
1AsyncRAT v...at.dll
windows10-2004-x64
1AsyncRAT v...ra.dll
windows10-2004-x64
1AsyncRAT v...er.dll
windows10-2004-x64
1AsyncRAT v...er.dll
windows10-2004-x64
1AsyncRAT v...er.dll
windows10-2004-x64
1AsyncRAT v...us.dll
windows10-2004-x64
1AsyncRAT v...ns.dll
windows10-2004-x64
1AsyncRAT v...er.dll
windows10-2004-x64
1AsyncRAT v...ry.dll
windows10-2004-x64
1AsyncRAT v...ra.dll
windows10-2004-x64
1AsyncRAT v...op.dll
windows10-2004-x64
5AsyncRAT v...le.dll
windows10-2004-x64
1AsyncRAT v...ry.dll
windows10-2004-x64
1AsyncRAT v...ub.exe
windows10-2004-x64
10Analysis
-
max time kernel
1717s -
max time network
1560s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2023 12:20
Behavioral task
behavioral1
Sample
COMPILED.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
AsyncRAT v0.5.7B/AsyncRAT.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
AsyncRAT v0.5.7B/AsyncRAT.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
AsyncRAT v0.5.7B/Fixer.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
AsyncRAT v0.5.7B/Plugins/Chat.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral6
Sample
AsyncRAT v0.5.7B/Plugins/Extra.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
AsyncRAT v0.5.7B/Plugins/FileManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
AsyncRAT v0.5.7B/Plugins/FileSearcher.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
AsyncRAT v0.5.7B/Plugins/LimeLogger.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
AsyncRAT v0.5.7B/Plugins/Miscellaneous.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
AsyncRAT v0.5.7B/Plugins/Options.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
AsyncRAT v0.5.7B/Plugins/ProcessManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
AsyncRAT v0.5.7B/Plugins/Recovery.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
AsyncRAT v0.5.7B/Plugins/RemoteCamera.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
AsyncRAT v0.5.7B/Plugins/RemoteDesktop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
AsyncRAT v0.5.7B/Plugins/SendFile.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
AsyncRAT v0.5.7B/Plugins/SendMemory.dll
Resource
win10v2004-20230220-en
General
-
Target
AsyncRAT v0.5.7B/AsyncRAT.exe.xml
-
Size
5KB
-
MD5
68fd5096a7df51bafad5ddb39ffc4eba
-
SHA1
14c74a1eefec2d1c67e4b0f081ce6e794b625a88
-
SHA256
28c532e21671a284e46bee6792f90e15f53093fbed16732e432867b8a48f2cbb
-
SHA512
acb42e52062e48eccd5b0153e4882e284d1bd7941b616d952f5d8c97f6f38df024dff699ac2e6b6a669d144072efe768b8d4ae56d28fd291ff44bad404c18502
-
SSDEEP
96:ur71Y7KY7KPrv0bGiv9Mr/apdgaRzV6RnwhXIJ0bGiveLapdgaRzV6RQyYKS4Ypa:ur7S7L7OrMmbCyYKS/pvrsJ+J/qJvr
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1291124207" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023086" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105a6151ee5fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7795DCA4-CBE1-11ED-BDA1-FE76446D24E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1319406300" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca130200000000020000000000106600000001000020000000d788e2c72a9591190dc87a63888949167257b4955b5bac748df0e10e701e4198000000000e8000000002000020000000f4f0e4842b0ce39664599a952f9745df6c735a18b89db7a376d36ef9821b331e200000006a6874ec8836d11212c4813a406917d1947e4d7b3d419aa050751351dd8cc2ac4000000048dd4819973c06335f03739bd0041aa39c306131839edd4a4334cda6c13e7d6291df992b549aa56391a1d9d4bf7e9bd9ca3e116f503d884a710b2b230ebedb56 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023086" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386605453" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1291124207" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0227251ee5fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31023086" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca1302000000000200000000001066000000010000200000002f97bf8c44228d9bd8f86673f083675df736af77557f55b037fb79493343af76000000000e8000000002000020000000e7e8b9d2086bfec5f9c5d258a8b4df6b83791e1dd1b9ca699776adbc72a99e03200000001310cf9084a1bacbf11f478989defb5f8220d07aaf38725299773df3e3889ef6400000003cb4dc4dbd0fc61e05b04c1de1a4d4907238a5d5d0895e4ed43ca616efc79f16a3d41f1ed97a75406f36f171cf77fbe4aea427fdd2da2211c2ea3e1c16cc5713 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1656 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1656 iexplore.exe 1656 iexplore.exe 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 2856 wrote to memory of 1656 2856 MSOXMLED.EXE iexplore.exe PID 2856 wrote to memory of 1656 2856 MSOXMLED.EXE iexplore.exe PID 1656 wrote to memory of 1884 1656 iexplore.exe IEXPLORE.EXE PID 1656 wrote to memory of 1884 1656 iexplore.exe IEXPLORE.EXE PID 1656 wrote to memory of 1884 1656 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AsyncRAT v0.5.7B\AsyncRAT.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AsyncRAT v0.5.7B\AsyncRAT.exe.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5f9eeb08fe84bc838ae6ac49893015c9b
SHA1529791696d3d8044dfb4dc0bbc5df47b4f5ed1a7
SHA2568effa7195753f0aa5c991f18df5866aed1e6688f8e484e47b6ecde0e2916d958
SHA5127f269c53a566998c1e3859eaaf96272224326e8959c86ad381869c2ebc6039518f74f3e4cbb71cb14d476ff4066d86705647fc60a0724f20ae07b0e1a51a3a4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5dbbe25209b3d5b99217d18adb6e59f3a
SHA1eb6c0160ef2c3a3718735e38b540e6d063223318
SHA256919bbbf71d51748d7a227d64c87272f475a3fa3fa41d239e030fa8593d4254df
SHA512d47b319cb472b3b214c99fdc59d289abc7aba52d9462437cebd00f76b474e7a0792b4e116d651ef93edaa89186873301f7b81a43075daa9ef1d9d198a7a8a905
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y624AVVJ\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/2856-133-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-134-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-135-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-136-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-137-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-138-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-139-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-140-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB
-
memory/2856-141-0x00007FFBB0E10000-0x00007FFBB0E20000-memory.dmpFilesize
64KB