Analysis
-
max time kernel
210s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27/04/2023, 03:48
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20230220-en
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
05db410247a5899d2784c9d79a7e9f7a
-
SHA1
9be286a04858d149eee48e4cb4f3e73ea5c5c2b8
-
SHA256
211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
-
SHA512
730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
-
SSDEEP
768:eu/6ZTgoiziWUUM9rmo2qrAcazlaQPIX1XVrbOi0bGf9omSH8M6AaQLczGdBDZgx:eu/6ZTgle2W9XFRUbGfe3laQLcazdgx
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:61288
146.70.165.10:61288
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
resource yara_rule behavioral1/memory/1712-54-0x0000000000970000-0x0000000000982000-memory.dmp asyncrat behavioral1/memory/1712-73-0x0000000000990000-0x00000000009B2000-memory.dmp asyncrat behavioral1/files/0x000700000001336a-105.dat asyncrat behavioral1/files/0x000700000001336a-106.dat asyncrat behavioral1/files/0x000700000001336a-107.dat asyncrat behavioral1/memory/1140-108-0x0000000000A30000-0x0000000000A42000-memory.dmp asyncrat behavioral1/memory/1140-128-0x0000000001FE0000-0x0000000002026000-memory.dmp asyncrat -
Deletes itself 1 IoCs
pid Process 1588 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1140 uduuix.exe -
Loads dropped DLL 1 IoCs
pid Process 1048 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1576 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1048 powershell.exe 1048 powershell.exe 1048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1712 AsyncClient.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeDebugPrivilege 1140 uduuix.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1948 1712 AsyncClient.exe 29 PID 1712 wrote to memory of 1948 1712 AsyncClient.exe 29 PID 1712 wrote to memory of 1948 1712 AsyncClient.exe 29 PID 1712 wrote to memory of 1948 1712 AsyncClient.exe 29 PID 1712 wrote to memory of 1588 1712 AsyncClient.exe 31 PID 1712 wrote to memory of 1588 1712 AsyncClient.exe 31 PID 1712 wrote to memory of 1588 1712 AsyncClient.exe 31 PID 1712 wrote to memory of 1588 1712 AsyncClient.exe 31 PID 1948 wrote to memory of 1048 1948 cmd.exe 33 PID 1948 wrote to memory of 1048 1948 cmd.exe 33 PID 1948 wrote to memory of 1048 1948 cmd.exe 33 PID 1948 wrote to memory of 1048 1948 cmd.exe 33 PID 1588 wrote to memory of 1576 1588 cmd.exe 34 PID 1588 wrote to memory of 1576 1588 cmd.exe 34 PID 1588 wrote to memory of 1576 1588 cmd.exe 34 PID 1588 wrote to memory of 1576 1588 cmd.exe 34 PID 1048 wrote to memory of 1140 1048 powershell.exe 35 PID 1048 wrote to memory of 1140 1048 powershell.exe 35 PID 1048 wrote to memory of 1140 1048 powershell.exe 35 PID 1048 wrote to memory of 1140 1048 powershell.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\uduuix.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\uduuix.exe"'3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\uduuix.exe"C:\Users\Admin\AppData\Local\Temp\uduuix.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp34A1.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:1576
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596ccfeedbda213a9d981806ab489e9d2
SHA11fa29939c3b7fb1deeeaadfe56170749949fcb94
SHA256972de393719468582b0a4ac16447741535714979dd79ad0da63641fc82bb84a7
SHA5126ef6cc915fec84a78afb9841d660b729de9ccfc21fd5105dc9ecfac70d47d17b94826fed422eec3900fc9a4f7729d785e7a3e7080f23e8a1c1a8864feef301ba
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
163B
MD5c700ad717c1362e59b93d823632762ba
SHA1493a92b9f1f9c7109af56ca9af4aa6ea6298ecdc
SHA2567d0db28fef33082a9b8f60fe5c1d699e119eafca248519402514aba20670d4db
SHA5129c0415ba39c424778dd278c88e3a309761b64b7b740f85b268b6a2746c904b2234a403c002a04bec9592733d4c00cf419c288fec7c23136d52cec7e8f3181748
-
Filesize
163B
MD5c700ad717c1362e59b93d823632762ba
SHA1493a92b9f1f9c7109af56ca9af4aa6ea6298ecdc
SHA2567d0db28fef33082a9b8f60fe5c1d699e119eafca248519402514aba20670d4db
SHA5129c0415ba39c424778dd278c88e3a309761b64b7b740f85b268b6a2746c904b2234a403c002a04bec9592733d4c00cf419c288fec7c23136d52cec7e8f3181748
-
Filesize
47KB
MD505db410247a5899d2784c9d79a7e9f7a
SHA19be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA256211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
SHA512730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
-
Filesize
47KB
MD505db410247a5899d2784c9d79a7e9f7a
SHA19be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA256211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
SHA512730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
-
Filesize
47KB
MD505db410247a5899d2784c9d79a7e9f7a
SHA19be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA256211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
SHA512730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d