asyncrat | f5d3df7ed5a6a84b14c3200752e6a43b3d8f23ab08fb0c1f7f7e192bb48cb206

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1wwyaeeCYc.exe
Size 96KB
Sample230601-mpymmsdg87
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

192.3.101.190:2015

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1868-144-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	1wwyaeeCYc.exe

Executes dropped EXE 1 IoCs

pid	Process
348	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	1wwyaeeCYc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 348 set thread context of 1868	348	svchost.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4700	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3896	timeout.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
4852	1wwyaeeCYc.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe
348	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	1wwyaeeCYc.exe
Token: SeDebugPrivilege	348	svchost.exe
Token: SeDebugPrivilege	1868	jsc.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3172	4852	1wwyaeeCYc.exe	84
PID 4852 wrote to memory of 3172	4852	1wwyaeeCYc.exe	84
PID 4852 wrote to memory of 4344	4852	1wwyaeeCYc.exe	85
PID 4852 wrote to memory of 4344	4852	1wwyaeeCYc.exe	85
PID 4344 wrote to memory of 3896	4344	cmd.exe	89
PID 4344 wrote to memory of 3896	4344	cmd.exe	89
PID 3172 wrote to memory of 4700	3172	cmd.exe	88
PID 3172 wrote to memory of 4700	3172	cmd.exe	88
PID 4344 wrote to memory of 348	4344	cmd.exe	90
PID 4344 wrote to memory of 348	4344	cmd.exe	90
PID 348 wrote to memory of 3880	348	svchost.exe	91
PID 348 wrote to memory of 3880	348	svchost.exe	91
PID 348 wrote to memory of 3964	348	svchost.exe	92
PID 348 wrote to memory of 3964	348	svchost.exe	92
PID 348 wrote to memory of 1132	348	svchost.exe	93
PID 348 wrote to memory of 1132	348	svchost.exe	93
PID 348 wrote to memory of 5032	348	svchost.exe	94
PID 348 wrote to memory of 5032	348	svchost.exe	94
PID 348 wrote to memory of 1712	348	svchost.exe	95
PID 348 wrote to memory of 1712	348	svchost.exe	95
PID 348 wrote to memory of 4084	348	svchost.exe	96
PID 348 wrote to memory of 4084	348	svchost.exe	96
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97
PID 348 wrote to memory of 1868	348	svchost.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe
"C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A26.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3896
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:348
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:3880
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:3964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1132
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:5032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:1712
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
      4⤵
      PID:4084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7A26.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7A26.tmp.bat
Size 151B
SHA256 1182aab26523a299e61d0cc146c21059973ac3d2626f2bee2ca932f883a25d96
MD5 ca2fae30ef5719d5fe371d0f50e7c106
SHA1 cd1e5d7e24f14b27c439d4c2aa2945c48ff8ce21
SHA512 5fd99a2cfdbc63a7fd4b5384e715937f5b8f240169bcd21d911882c04a598b673f1cdd63eee586b158515a837bedd9532274e886f0aef7ca339188ab3d238732
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 96KB
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 96KB
SHA256 a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
MD5 749fdef07e576ac40e42568780bd26bd
SHA1 93d0094038126ec31a5f0a9251318cdfb163cade
SHA512 d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP 1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1868-144-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1868-146-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/1868-147-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/1868-148-0x0000000005680000-0x000000000571C000-memory.dmp

Download

memory/1868-149-0x0000000005CD0000-0x0000000006274000-memory.dmp

Download

memory/1868-150-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/1868-151-0x00000000069C0000-0x0000000006A36000-memory.dmp

Download

memory/1868-152-0x0000000006A60000-0x0000000006A7E000-memory.dmp

Download

memory/4852-134-0x000001271D4A0000-0x000001271D4B0000-memory.dmp

Download

memory/4852-135-0x000001271DD30000-0x000001271E258000-memory.dmp

Download

memory/4852-133-0x0000012703060000-0x000001270307C000-memory.dmp

Download