asyncrat | f5d3df7ed5a6a84b14c3200752e6a43b3d8f23ab08fb0c1f7f7e192bb48cb206

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wwyaeeCYc.exe
Size 96KB
Sample230601-gyf63ach64
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

192.3.101.190:2015

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4872-144-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	1wwyaeeCYc.exe

Executes dropped EXE 1 IoCs

pid	Process
384	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	1wwyaeeCYc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 4872	384	svchost.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2124	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4008	timeout.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
4388	1wwyaeeCYc.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	1wwyaeeCYc.exe
Token: SeDebugPrivilege	384	svchost.exe
Token: SeDebugPrivilege	4872	AddInProcess32.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2560	4388	1wwyaeeCYc.exe	84
PID 4388 wrote to memory of 2560	4388	1wwyaeeCYc.exe	84
PID 4388 wrote to memory of 1596	4388	1wwyaeeCYc.exe	86
PID 4388 wrote to memory of 1596	4388	1wwyaeeCYc.exe	86
PID 1596 wrote to memory of 4008	1596	cmd.exe	88
PID 1596 wrote to memory of 4008	1596	cmd.exe	88
PID 2560 wrote to memory of 2124	2560	cmd.exe	89
PID 2560 wrote to memory of 2124	2560	cmd.exe	89
PID 1596 wrote to memory of 384	1596	cmd.exe	90
PID 1596 wrote to memory of 384	1596	cmd.exe	90
PID 384 wrote to memory of 952	384	svchost.exe	91
PID 384 wrote to memory of 952	384	svchost.exe	91
PID 384 wrote to memory of 1472	384	svchost.exe	92
PID 384 wrote to memory of 1472	384	svchost.exe	92
PID 384 wrote to memory of 3876	384	svchost.exe	93
PID 384 wrote to memory of 3876	384	svchost.exe	93
PID 384 wrote to memory of 100	384	svchost.exe	94
PID 384 wrote to memory of 100	384	svchost.exe	94
PID 384 wrote to memory of 224	384	svchost.exe	95
PID 384 wrote to memory of 224	384	svchost.exe	95
PID 384 wrote to memory of 116	384	svchost.exe	96
PID 384 wrote to memory of 116	384	svchost.exe	96
PID 384 wrote to memory of 212	384	svchost.exe	97
PID 384 wrote to memory of 212	384	svchost.exe	97
PID 384 wrote to memory of 180	384	svchost.exe	98
PID 384 wrote to memory of 180	384	svchost.exe	98
PID 384 wrote to memory of 3132	384	svchost.exe	99
PID 384 wrote to memory of 3132	384	svchost.exe	99
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100
PID 384 wrote to memory of 4872	384	svchost.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe
"C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB0F5.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4008
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
      4⤵
      PID:952
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
      4⤵
      PID:1472
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:3876
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:116
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
      4⤵
      PID:212
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:180
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:3132
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB0F5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB0F5.tmp.bat
Size 151B
SHA256 87eac010084adf722bb0e2ed9d7893187844e2dbabea1511a2de18e5aa7b9ca4
MD5 70699d9c7dc321fb7397b664ce0149a5
SHA1 c68f4ee729a1f757f10e8dc4285f8c07dfc62bfe
SHA512 13642b35b80b77f41f62953d95425d2471519d7d8cabfdd4ed740ae27449946228f54ff912908afddbf4416a1a51c37285b8187acf67924fbed79480b0fc50d0
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 96KB
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 96KB
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4388-133-0x00000210425E0000-0x00000210425FC000-memory.dmp

Download

memory/4388-134-0x000002105CB10000-0x000002105CB20000-memory.dmp

Download

memory/4388-135-0x000002105D070000-0x000002105D598000-memory.dmp

Download

memory/4872-144-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4872-146-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4872-147-0x0000000005BD0000-0x0000000005C6C000-memory.dmp

Download

memory/4872-148-0x0000000006220000-0x00000000067C4000-memory.dmp

Download

memory/4872-149-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/4872-150-0x0000000006FD0000-0x0000000007046000-memory.dmp

Download

memory/4872-151-0x0000000007080000-0x000000000709E000-memory.dmp

Download

memory/4872-152-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download