asyncrat | 8501de3d3e0cb356f11439fc0425a60e8aefd8c24ed7015fffff4334d63e962b

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Microsoft.ps1
Size 218KB
Sample230403-mmn1esff2v
SHA256 8501de3d3e0cb356f11439fc0425a60e8aefd8c24ed7015fffff4334d63e962b
MD5 ca38aaf8ede575784e240b6f2ea5c948
SHA1 77aac617067526993329f6dcb76446f62b658f06
SHA512 eb0e4a0e5f62f990fe1708967dd54f76ab72088c2b79786af21f80a195884612e5aed391c99541d5895101345051b7806ccc05ed991e4128b5d42d03b011e0e8
SSDEEP 3072:QTPTwLhFrOBsc4VsTKkcU/DNv9O9dDp5+NYuK5sj315j3Apx:kwLKpKkcUbNv9OPpYNYuKq315j3Apx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat us rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

185.81.157.209:2301

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2160-183-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 2160	3224	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2604	powershell.exe
2604	powershell.exe
4116	powershell.exe
4116	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	2160	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4612	2604	powershell.exe	89
PID 2604 wrote to memory of 4612	2604	powershell.exe	89
PID 5048 wrote to memory of 4116	5048	WScript.exe	94
PID 5048 wrote to memory of 4116	5048	WScript.exe	94
PID 4116 wrote to memory of 4748	4116	powershell.exe	96
PID 4116 wrote to memory of 4748	4116	powershell.exe	96
PID 4748 wrote to memory of 3848	4748	cmd.exe	97
PID 4748 wrote to memory of 3848	4748	cmd.exe	97
PID 3848 wrote to memory of 3224	3848	mshta.exe	98
PID 3848 wrote to memory of 3224	3848	mshta.exe	98
PID 3224 wrote to memory of 5116	3224	powershell.exe	100
PID 3224 wrote to memory of 5116	3224	powershell.exe	100
PID 3224 wrote to memory of 5116	3224	powershell.exe	100
PID 3224 wrote to memory of 5104	3224	powershell.exe	101
PID 3224 wrote to memory of 5104	3224	powershell.exe	101
PID 3224 wrote to memory of 5104	3224	powershell.exe	101
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102
PID 3224 wrote to memory of 2160	3224	powershell.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Microsoft.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 2 /tn Screenshot /tr C:\ProgramData\Document\Screenshot.vbs
  2⤵
  - Creates scheduled task(s)
  PID:4612

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\Document\Screenshot.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &{ C:\ProgramData\Document\Microsoft.bat}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Document\Microsoft.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powe"+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+"rshell -Execu"+"tionP"+"olicy"+" Bypass & 'C:\ProgramData\Document\py.ps1'"", 0:close")
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\ProgramData\Document\py.ps1'
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        
        PID:5116
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        
        PID:5104
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.bat

Path C:\ProgramData\Document\Microsoft.bat
Size 272B
SHA256 146b6f80e49562c0e3e45295a9c78ce1f8a0460e997716103e030b5f304e1a3d
MD5 9baaf1099996241de9c906be2aa43ae1
SHA1 9e5bc0308f4610a3870732f4c9cf707fe5cc7434
SHA512 9218c8739eda384c23ba9cc3ae36b46b32ad424bc6275fc9126104f376be0fd5289b0e1eebcf29835c217c780bfb578131ba05fc5e90a3ebba0f67288d4937e1
MD5 SHA1 SHA512

Submit Download

Screenshot.vbs

Path C:\ProgramData\Document\Screenshot.vbs
Size 195B
SHA256 e8cef70a6cfc1f944dbfb5fc66723cfb7045eaf87fa4c7067505707d5b109b6e
MD5 a16b4f3420652090ad4f0fe0b75ef58c
SHA1 0c78a4b05387c4a6ec88429aa1a0c7c84fa3c461
SHA512 528c7bd9f105a8951059cd143b6e16bbd8f8504d20b7340ee3799976fcc8649ea8a56ba7dceddc3ed37802fd61bf26c329712d8cd54c25ab906128423a7e14ca
MD5 SHA1 SHA512

Submit Download

py.ps1

Path C:\ProgramData\Document\py.ps1
Size 216KB
SHA256 4109894feb84432ea5478ab7350a631098160161cda4c3a809942243ca3edb96
MD5 352f212f421cc8240323d1c98e12ac08
SHA1 f6d2d05bdefe518c6970e35608bf3231b8f9a5a0
SHA512 7b717d0401bed2d466204a0f8a2cbc9c5d4fa40c1295db0233fef56e3dcab47b0a8e25d633152c6e0767c0bfb1129e8c079eb135e9ebe91d12473d18d47cfa71
SSDEEP 3072:3TPTwLhFrOBsc4VsTKkcU/DNv9O9dDp5+NYuK5sj315j3Apr:/wLKpKkcUbNv9OPpYNYuKq315j3Apr
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ef8cd66cc241c6d899919ae6f8369334b20202bd4ad49acfa546d29300c533d2
MD5 27fdb1beb89b56345e585d480be3026b
SHA1 2626e41ca27668518d01c04e1579f77027ff31a1
SHA512 bd8208c8763ad8a6c25b6363b8e0e2a3c694e4e0cabfe4ce5d40945bd1f4274b7da976997f825e95c4455bf6b2e20b5bd960609b172f7c70d3521cb2ab24d49a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_p05qorki.mjr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p05qorki.mjr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2160-183-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2160-190-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/2160-189-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/2160-188-0x00000000059B0000-0x0000000005F54000-memory.dmp

Download

memory/2160-187-0x0000000005360000-0x00000000053FC000-memory.dmp

Download

memory/2160-186-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/2604-143-0x0000027F1C620000-0x0000027F1C630000-memory.dmp

Download

memory/2604-138-0x0000027F1C4F0000-0x0000027F1C512000-memory.dmp

Download

memory/2604-145-0x0000027F1C620000-0x0000027F1C630000-memory.dmp

Download

memory/2604-144-0x0000027F1C620000-0x0000027F1C630000-memory.dmp

Download

memory/3224-180-0x0000028D9D000000-0x0000028D9D010000-memory.dmp

Download

memory/3224-179-0x0000028D9D000000-0x0000028D9D010000-memory.dmp

Download

memory/3224-178-0x0000028D9D000000-0x0000028D9D010000-memory.dmp

Download

memory/4116-165-0x00000175B17B0000-0x00000175B17C0000-memory.dmp

Download