Malware Analysis Report

2025-08-05 12:31

Sample ID 230505-bthlfafh82
Target 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491

Threat Level: Known bad

The file 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Async RAT payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-05 01:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-05 01:26

Reported

2023-05-05 01:28

Platform

win7-20230220-en

Max time kernel

57s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\microsafte.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\microsafte.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 1428 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1748 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1748 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1748 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1748 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1748 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe
PID 1748 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe
PID 1748 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe
PID 1748 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe

Processes

C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe

"C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp979F.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\microsafte.exe

"C:\Users\Admin\AppData\Roaming\microsafte.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 milla.publicvm.com udp
NL 91.109.178.2:7707 milla.publicvm.com tcp

Files

memory/1972-54-0x0000000000EB0000-0x0000000000F98000-memory.dmp

memory/1972-55-0x00000000002F0000-0x0000000000302000-memory.dmp

memory/1972-56-0x0000000004C30000-0x0000000004C70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp979F.tmp.bat

MD5 c0e47243cf886f25ba5f9b5297cbf134
SHA1 968badeea011e1164234bf8462630ede29a094f1
SHA256 4e3dc7bb575820da992597b43bca9fce6170ddce880aa42e9ad530be6c4f8f44
SHA512 5b1b9e89e97a193d8bc50a07e96c842c73af3910b240f785a4a29ff403bb0624b09129632eca1bf9128854a08894b276cbcd173456afca102c43791b8a01c7a1

C:\Users\Admin\AppData\Local\Temp\tmp979F.tmp.bat

MD5 c0e47243cf886f25ba5f9b5297cbf134
SHA1 968badeea011e1164234bf8462630ede29a094f1
SHA256 4e3dc7bb575820da992597b43bca9fce6170ddce880aa42e9ad530be6c4f8f44
SHA512 5b1b9e89e97a193d8bc50a07e96c842c73af3910b240f785a4a29ff403bb0624b09129632eca1bf9128854a08894b276cbcd173456afca102c43791b8a01c7a1

\Users\Admin\AppData\Roaming\microsafte.exe

MD5 c011326ff5f864290617144c3dddcc88
SHA1 257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512 894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a

C:\Users\Admin\AppData\Roaming\microsafte.exe

MD5 c011326ff5f864290617144c3dddcc88
SHA1 257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512 894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a

C:\Users\Admin\AppData\Roaming\microsafte.exe

MD5 c011326ff5f864290617144c3dddcc88
SHA1 257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512 894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a

memory/1164-69-0x0000000000AD0000-0x0000000000BB8000-memory.dmp

memory/1164-70-0x0000000004CF0000-0x0000000004D30000-memory.dmp

memory/1164-85-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-05 01:26

Reported

2023-05-05 01:28

Platform

win10v2004-20230221-en

Max time kernel

89s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\microsafte.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\microsafte.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 4620 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 4620 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 4620 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 4620 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 4620 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe C:\Windows\SysWOW64\cmd.exe
PID 3404 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3404 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3404 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 924 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 924 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 924 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3404 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe
PID 3404 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe
PID 3404 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microsafte.exe

Processes

C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe

"C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE0A1.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\microsafte.exe

"C:\Users\Admin\AppData\Roaming\microsafte.exe"

Network

Country Destination Domain Proto
US 52.242.101.226:443 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 138.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 20.42.65.90:443 tcp
US 8.8.8.8:53 milla.publicvm.com udp
NL 91.109.178.2:8808 milla.publicvm.com tcp
US 8.8.8.8:53 2.178.109.91.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp

Files

memory/4620-133-0x0000000000ED0000-0x0000000000FB8000-memory.dmp

memory/4620-134-0x0000000005EB0000-0x0000000006454000-memory.dmp

memory/4620-135-0x00000000059A0000-0x0000000005A32000-memory.dmp

memory/4620-136-0x0000000005A40000-0x0000000005ADC000-memory.dmp

memory/4620-137-0x0000000005B60000-0x0000000005B70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE0A1.tmp.bat

MD5 1f20853892eca7672700b4cd711f51a0
SHA1 0fa6cc3193eed0309420b599a693ddcf059cdb04
SHA256 2bef5ded7df5b5adc68ce46e54ba4b667c0859dc763ee2a098408a50073a6df7
SHA512 501e2302f69490145a7287765e81ece2bc057e262e7cbb9c79a66f86ca24004a130d2043722794ef8d48bcf1421555937b1e0617d3e0d0b119a3898954ff0cc1

C:\Users\Admin\AppData\Roaming\microsafte.exe

MD5 c011326ff5f864290617144c3dddcc88
SHA1 257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512 894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a

C:\Users\Admin\AppData\Roaming\microsafte.exe

MD5 c011326ff5f864290617144c3dddcc88
SHA1 257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA256 35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512 894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a

memory/3792-146-0x0000000005110000-0x0000000005120000-memory.dmp

memory/3792-147-0x0000000005CE0000-0x0000000005D46000-memory.dmp

memory/3792-148-0x0000000005110000-0x0000000005120000-memory.dmp