asyncrat | 211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2023, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AsyncClient.exe
Size 47KB
Sample230427-ec181ade43
SHA256 211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
MD5 05db410247a5899d2784c9d79a7e9f7a
SHA1 9be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA512 730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
SSDEEP 768:eu/6ZTgoiziWUUM9rmo2qrAcazlaQPIX1XVrbOi0bGf9omSH8M6AaQLczGdBDZgx:eu/6ZTgle2W9XFRUbGfe3laQLcazdgx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:61288
146.70.165.10:61288

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4708-133-0x0000000000F70000-0x0000000000F82000-memory.dmp	asyncrat
behavioral2/files/0x00020000000225be-167.dat	asyncrat
behavioral2/files/0x00020000000225be-168.dat	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 1 IoCs

pid	Process
404	kbukxp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2848	timeout.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3836	powershell.exe
3836	powershell.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe
404	kbukxp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	AsyncClient.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	404	kbukxp.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2304	4708	AsyncClient.exe	88
PID 4708 wrote to memory of 2304	4708	AsyncClient.exe	88
PID 4708 wrote to memory of 2304	4708	AsyncClient.exe	88
PID 4708 wrote to memory of 3776	4708	AsyncClient.exe	90
PID 4708 wrote to memory of 3776	4708	AsyncClient.exe	90
PID 4708 wrote to memory of 3776	4708	AsyncClient.exe	90
PID 2304 wrote to memory of 3836	2304	cmd.exe	92
PID 2304 wrote to memory of 3836	2304	cmd.exe	92
PID 2304 wrote to memory of 3836	2304	cmd.exe	92
PID 3776 wrote to memory of 2848	3776	cmd.exe	93
PID 3776 wrote to memory of 2848	3776	cmd.exe	93
PID 3776 wrote to memory of 2848	3776	cmd.exe	93
PID 3836 wrote to memory of 404	3836	powershell.exe	94
PID 3836 wrote to memory of 404	3836	powershell.exe	94
PID 3836 wrote to memory of 404	3836	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kbukxp.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kbukxp.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\kbukxp.exe
      "C:\Users\Admin\AppData\Local\Temp\kbukxp.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8F25.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mrytyxg5.fka.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrytyxg5.fka.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

kbukxp.exe

Path C:\Users\Admin\AppData\Local\Temp\kbukxp.exe
Size 47KB
SHA256 211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
MD5 05db410247a5899d2784c9d79a7e9f7a
SHA1 9be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA512 730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
SSDEEP 768:eu/6ZTgoiziWUUM9rmo2qrAcazlaQPIX1XVrbOi0bGf9omSH8M6AaQLczGdBDZgx:eu/6ZTgle2W9XFRUbGfe3laQLcazdgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

kbukxp.exe

Path C:\Users\Admin\AppData\Local\Temp\kbukxp.exe
Size 47KB
SHA256 211b91753a7aa02a6ab3a2fafdd350c4c82870b8982fdecfe4f18ef0fcfa277b
MD5 05db410247a5899d2784c9d79a7e9f7a
SHA1 9be286a04858d149eee48e4cb4f3e73ea5c5c2b8
SHA512 730325ce9cb5553c9e208ab34db04efde78c38ddea36a6d13bd47fb54fd0bc973d51604b0c03e83464c4f6dbb301d90cca835a98d457e2e5d56cf8ef65d0254d
SSDEEP 768:eu/6ZTgoiziWUUM9rmo2qrAcazlaQPIX1XVrbOi0bGf9omSH8M6AaQLczGdBDZgx:eu/6ZTgle2W9XFRUbGfe3laQLcazdgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp8F25.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8F25.tmp.bat
Size 163B
SHA256 ae4f4b44729ea269e263db938365ea8bba403e812066d91519dcc3ac6132038e
MD5 2ef77f4dcd456d76af721b9b69a3a7d2
SHA1 34391cb02820681decb287c4b04075c61665e8f8
SHA512 18fa71d26bc5e9c24429de6a7eed66c63fe411a44279d81928e4fc4f55e088241227faebef4c33bb5e12747d07a9241fb233662395f79a5452c7c194370ade4d
MD5 SHA1 SHA512

Submit Download

memory/404-173-0x0000000006B70000-0x0000000006C02000-memory.dmp

Download

memory/404-172-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Download

memory/404-171-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Download

memory/3836-165-0x0000000005F80000-0x0000000005FA2000-memory.dmp

Download

memory/3836-163-0x0000000005FB0000-0x0000000006046000-memory.dmp

Download

memory/3836-148-0x0000000004B20000-0x0000000005148000-memory.dmp

Download

memory/3836-149-0x0000000005220000-0x0000000005242000-memory.dmp

Download

memory/3836-166-0x0000000002110000-0x0000000002120000-memory.dmp

Download

memory/3836-155-0x0000000005340000-0x00000000053A6000-memory.dmp

Download

memory/3836-160-0x0000000002110000-0x0000000002120000-memory.dmp

Download

memory/3836-161-0x0000000002110000-0x0000000002120000-memory.dmp

Download

memory/3836-162-0x0000000005A40000-0x0000000005A5E000-memory.dmp

Download

memory/3836-147-0x00000000044B0000-0x00000000044E6000-memory.dmp

Download

memory/3836-164-0x0000000005F30000-0x0000000005F4A000-memory.dmp

Download

memory/4708-133-0x0000000000F70000-0x0000000000F82000-memory.dmp

Download

memory/4708-141-0x0000000007260000-0x000000000727E000-memory.dmp

Download

memory/4708-140-0x0000000007290000-0x0000000007306000-memory.dmp

Download

memory/4708-139-0x0000000006260000-0x00000000062C6000-memory.dmp

Download

memory/4708-138-0x00000000067A0000-0x0000000006D44000-memory.dmp

Download

memory/4708-137-0x0000000006150000-0x00000000061EC000-memory.dmp

Download

memory/4708-134-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download