Malware Analysis Report

2025-08-06 03:44

Sample ID 230427-f7298afg6t
Target AsyncClient.exe
SHA256 2feff6f4c4076cf3938109607fe65dd5f0de893aad9ea2e732a2a37f3aa55f35
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2feff6f4c4076cf3938109607fe65dd5f0de893aad9ea2e732a2a37f3aa55f35

Threat Level: Known bad

The file AsyncClient.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Async RAT payload

AsyncRat

Asyncrat family

Async RAT payload

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-27 05:31

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-27 05:31

Reported

2023-04-27 05:34

Platform

win10v2004-20230220-en

Max time kernel

65s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft Update.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft Update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4164 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4164 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4164 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4164 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4164 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 4164 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1584 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1584 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3484 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3484 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3484 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1584 wrote to memory of 4540 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft Update.exe
PID 1584 wrote to memory of 4540 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft Update.exe
PID 1584 wrote to memory of 4540 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft Update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe

"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Update" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp14A1.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Update" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Microsoft Update.exe

"C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 133.17.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
IE 20.50.80.210:443 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
N/A 127.0.0.1:61288 tcp
N/A 127.0.0.1:61288 tcp
N/A 127.0.0.1:61288 tcp
NL 8.238.179.126:80 tcp
NL 173.223.113.164:443 tcp
US 146.70.165.10:61288 tcp
US 8.8.8.8:53 10.165.70.146.in-addr.arpa udp
US 146.70.165.10:61288 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
NL 8.238.179.126:80 tcp

Files

memory/4164-133-0x0000000000450000-0x0000000000462000-memory.dmp

memory/4164-134-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

memory/4164-135-0x0000000004F70000-0x000000000500C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp14A1.tmp.bat

MD5 37865e9459775c3ef1631b199545b835
SHA1 1001e6bcdfd3036e6e8c06361f824035a985fbd4
SHA256 f0fb23cd2de16411075f6c84cc7646d59692b1b0ad6ff180ac69629b679c5024
SHA512 7446f703a60c804cc2abe0c70e71d045be2017862df4a75e1fa55854f539ea10bfb0e9b4c609494ec36bbd37bf83896afa426accbfb01773721fb592ac8a75f0

C:\Users\Admin\AppData\Roaming\Microsoft Update.exe

MD5 f543c4cf51fb25b1bacb1bd54b9d8bc1
SHA1 13b1846a380f4a4840cce067d274d1d0eaf4076e
SHA256 2feff6f4c4076cf3938109607fe65dd5f0de893aad9ea2e732a2a37f3aa55f35
SHA512 d3c7fcc79a69cdd87dbc873a237dcb963d8f14d80a63674384070538fafbde9230056c487a0833903608b71551104db7ef07ef3644b4ece4811de64bce8bdeb0

C:\Users\Admin\AppData\Roaming\Microsoft Update.exe

MD5 f543c4cf51fb25b1bacb1bd54b9d8bc1
SHA1 13b1846a380f4a4840cce067d274d1d0eaf4076e
SHA256 2feff6f4c4076cf3938109607fe65dd5f0de893aad9ea2e732a2a37f3aa55f35
SHA512 d3c7fcc79a69cdd87dbc873a237dcb963d8f14d80a63674384070538fafbde9230056c487a0833903608b71551104db7ef07ef3644b4ece4811de64bce8bdeb0

memory/4540-144-0x0000000005880000-0x0000000005890000-memory.dmp

memory/4540-145-0x0000000005880000-0x0000000005890000-memory.dmp

memory/4540-146-0x0000000006120000-0x00000000066C4000-memory.dmp

memory/4540-147-0x0000000005B70000-0x0000000005BD6000-memory.dmp