asyncrat | 33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11

Analysis

max time kernel
103s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe
Size 1.0MB
Sample230504-rcz26aef8s
SHA256 33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11
MD5 40007c48c4a68c28353bc2263e46a8aa
SHA1 edc72a9967bda687d56ddfe0fddbca15d0c40035
SHA512 2c6b5b33cf6338f8db9d81e51cdcd7782753dc25e26806a5ba8fa6c8982abc3c898c28751060f5c697a511c59ab6a4b9e24a234fa1f000ae14086815152fef77
SSDEEP 24576:NTbBv5rUanOuF+8bQybXmmNxrndGryTBZPa:HBjbs8bQSXVdGoBZy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

37.120.210.219:48408

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1452-293-0x0000000000E00000-0x0000000001310000-memory.dmp	asyncrat
behavioral2/memory/1452-294-0x0000000000E00000-0x0000000000E12000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
916	adtaa.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	adtaa.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwp\\adtaa.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwp\\xlsetqc.ppt"	adtaa.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 1452	916	adtaa.pif	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif
916	adtaa.pif

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 560	2236	33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe	76
PID 2236 wrote to memory of 560	2236	33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe	76
PID 2236 wrote to memory of 560	2236	33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe	76
PID 560 wrote to memory of 916	560	wscript.exe	78
PID 560 wrote to memory of 916	560	wscript.exe	78
PID 560 wrote to memory of 916	560	wscript.exe	78
PID 916 wrote to memory of 1452	916	adtaa.pif	83
PID 916 wrote to memory of 1452	916	adtaa.pif	83
PID 916 wrote to memory of 1452	916	adtaa.pif	83
PID 916 wrote to memory of 1452	916	adtaa.pif	83
PID 916 wrote to memory of 1452	916	adtaa.pif	83

C:\Users\Admin\AppData\Local\Temp\33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe
"C:\Users\Admin\AppData\Local\Temp\33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" Update-ed.l.vbe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Users\Admin\AppData\Local\Temp\qgwp\adtaa.pif
    "C:\Users\Admin\AppData\Local\Temp\qgwp\adtaa.pif" xlsetqc.ppt
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DOQAJM~1.DQO

Path C:\Users\Admin\AppData\Local\Temp\qgwp\DOQAJM~1.DQO
Size 74KB
SHA256 712d9958d3170f73f7bc4f7c6ed28caadbbeaf079050f58dda4fadfe0f4217f7
MD5 3ae20ce17c62eb5f5245231299021949
SHA1 20d193dc3fdee620995e22f128c5f92414710ac1
SHA512 d542ac65a223dc5c2d314a80ef2d87562e0dedea6f1c7b586ce94fa8751601ebd55482aa200816ad6f03709623d6936913f94404684ee278efb3b18f370e7aac
SSDEEP 1536:U2UJAcTJlHnsSJCs6ocevKSXuSXOCSXySX9SXxrnG2s+gkiXd6EZdN9Z38tK3S0i:UkCHscCsI53S0TpLSSnbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update-ed.l.vbe

Path C:\Users\Admin\AppData\Local\Temp\qgwp\Update-ed.l.vbe
Size 69KB
SHA256 c26727e311cb18de7dd06f1874771d04b54b97b3d674b13e59e2fd2e30242629
MD5 4d361bf174b8f3c66723f6064ee193bd
SHA1 3a02969739022aa8a505da0d7d88671d8a1acbdb
SHA512 a2991a75f1dba9747dfce7bc69b15c568aaa20b592703c9d9673be4394684deebb47be7c4d8d28461edec9caea6310c2f66ca464e65a1f3ec86e85cc79a94c33
SSDEEP 1536:Ij2zj2aj2Qj2mj2Lj2tj2Pj2tj24j20j2aj20j2Ej2Ej2Wj2y:IazaaaQamaLataPata4a0aaa0aEaEaWH
MD5 SHA1 SHA512 SSDEEP

Submit Download

adtaa.pif

Path C:\Users\Admin\AppData\Local\Temp\qgwp\adtaa.pif
Size 1.2MB
SHA256 0323b0cbc6726d09c091163fa80885b93d91ece8394cbad0bb87e4e38a756798
MD5 d08467871656edc79c1dfe974d91c450
SHA1 226105367ba3663becdde32280b1714fdcacebcb
SHA512 fcb659bd06031e6b3b3b0c03620aeb8a526c6eae6f17db717dd4703a3edc98e8392a5e8118c47db52933c05e2f8fe0cc3eb747f85ff0f0a910bf6142ccbb2fa7
SSDEEP 24576:kYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaUDwpeJTzwpewTV:k37+KSbq5e1diEnHaUcpe9spewx
MD5 SHA1 SHA512 SSDEEP

Submit Download

adtaa.pif

Path C:\Users\Admin\AppData\Local\Temp\qgwp\adtaa.pif
Size 1.2MB
SHA256 0323b0cbc6726d09c091163fa80885b93d91ece8394cbad0bb87e4e38a756798
MD5 d08467871656edc79c1dfe974d91c450
SHA1 226105367ba3663becdde32280b1714fdcacebcb
SHA512 fcb659bd06031e6b3b3b0c03620aeb8a526c6eae6f17db717dd4703a3edc98e8392a5e8118c47db52933c05e2f8fe0cc3eb747f85ff0f0a910bf6142ccbb2fa7
SSDEEP 24576:kYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaUDwpeJTzwpewTV:k37+KSbq5e1diEnHaUcpe9spewx
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbwh.dat

Path C:\Users\Admin\AppData\Local\Temp\qgwp\tbwh.dat
Size 36KB
SHA256 ae3c368a3963c3537e502cc6607e8035c91a090eb60ff33361c49aef57a2af33
MD5 301e1eec6742011e08e120355c2b0764
SHA1 6e970f19e25d7fe0a065d0b7b30107eaaf775130
SHA512 b54ff0649341a09f15ef933f1bfc495a655c6ae0dd8e0cce1884af0fa7392b1376820bd429505e7b426537b522058877f90c07c7dfda29c6c7bb98ac62149c74
SSDEEP 768:QrjichBDloAWYBNLXuwp6AMlhG508rNsaQYLIlsUOZ6UXny:MjVhBDSAWYBNLXuwgAZRsaJ1Xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

xlsetqc.ppt

Path C:\Users\Admin\AppData\Local\Temp\qgwp\xlsetqc.ppt
Size 86.1MB
SHA256 aec4c6528ce074e4a90a7949a1acde52f58d469fec9600ff259a65e25299b449
MD5 ef053f9b9f535a7a446b31089da3e14f
SHA1 b34f1ed41e99fa59d3a81e1f94d9e0c442f8bd53
SHA512 7f1990eb756fc21d59f18828eda6051d605bbc8f4206a4bc47047f15ae17565eae75fdfda1a217280c77b6b7f8fe9c3b72cac90466aa8b769ded166df1c45cf5
SSDEEP 49152:m8lHVaQUx327YeiYExM36sAITdL0I09oFzOGQuXKc2LamdJwn29RvR1R7fS2MvZ/:l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1452-293-0x0000000000E00000-0x0000000001310000-memory.dmp

Download

memory/1452-294-0x0000000000E00000-0x0000000000E12000-memory.dmp

Download

memory/1452-295-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/1452-298-0x0000000006120000-0x00000000061BC000-memory.dmp

Download

memory/1452-299-0x0000000006770000-0x0000000006D14000-memory.dmp

Download

memory/1452-300-0x0000000006230000-0x0000000006296000-memory.dmp

Download

memory/1452-301-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download