asyncrat | 2869fbcf083c03c7cd55e45661f6df089fdf169b1719d5052a52e2e386bf3a6d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

336KB
MD5

7f5fd6228a8d8edf2c88d1b34cb8c847
SHA1

408049adf245bcad778add0903c6803a4d691d3f
SHA256

2869fbcf083c03c7cd55e45661f6df089fdf169b1719d5052a52e2e386bf3a6d
SHA512

4ec90147cdace22b9a14d776fe28837994689553aeef682597a4e218a44ca68a0227131987ed28f6458ca6ba478f2e1f39785f99c98154a301a5affb37a755ab
SSDEEP

6144:DT9zpYsT9/xBDwYQJkaLVo/DtBI6C39gMGHQuwDBOknXcMbE+:DYsZ/bxQJDVODtBtOgOuYO8Xb

Score

10^/10

asyncrat default evasion persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.1

Botnet

Default

Mutex

vrmctetyuyojxzjvffl

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/WD485ntt

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1880-81-0x0000000000400000-0x0000000000418000-memory.dmp	asyncrat

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1172	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
296	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 1880	1172	svchost.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	1880	WerFault.exe	41

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
984	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1396	timeout.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	file.exe
1184	powershell.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe
1172	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1172	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	file.exe
Token: SeDebugPrivilege	1172	svchost.exe
Token: SeDebugPrivilege	1172	svchost.exe
Token: SeLoadDriverPrivilege	1172	svchost.exe
Token: SeDebugPrivilege	1184	powershell.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 916	624	file.exe	28
PID 624 wrote to memory of 916	624	file.exe	28
PID 624 wrote to memory of 916	624	file.exe	28
PID 624 wrote to memory of 296	624	file.exe	30
PID 624 wrote to memory of 296	624	file.exe	30
PID 624 wrote to memory of 296	624	file.exe	30
PID 916 wrote to memory of 984	916	cmd.exe	32
PID 916 wrote to memory of 984	916	cmd.exe	32
PID 916 wrote to memory of 984	916	cmd.exe	32
PID 296 wrote to memory of 1396	296	cmd.exe	33
PID 296 wrote to memory of 1396	296	cmd.exe	33
PID 296 wrote to memory of 1396	296	cmd.exe	33
PID 296 wrote to memory of 1172	296	cmd.exe	34
PID 296 wrote to memory of 1172	296	cmd.exe	34
PID 296 wrote to memory of 1172	296	cmd.exe	34
PID 1172 wrote to memory of 1184	1172	svchost.exe	35
PID 1172 wrote to memory of 1184	1172	svchost.exe	35
PID 1172 wrote to memory of 1184	1172	svchost.exe	35
PID 1172 wrote to memory of 1016	1172	svchost.exe	37
PID 1172 wrote to memory of 1016	1172	svchost.exe	37
PID 1172 wrote to memory of 1016	1172	svchost.exe	37
PID 1172 wrote to memory of 1680	1172	svchost.exe	38
PID 1172 wrote to memory of 1680	1172	svchost.exe	38
PID 1172 wrote to memory of 1680	1172	svchost.exe	38
PID 1172 wrote to memory of 1616	1172	svchost.exe	39
PID 1172 wrote to memory of 1616	1172	svchost.exe	39
PID 1172 wrote to memory of 1616	1172	svchost.exe	39
PID 1172 wrote to memory of 1840	1172	svchost.exe	40
PID 1172 wrote to memory of 1840	1172	svchost.exe	40
PID 1172 wrote to memory of 1840	1172	svchost.exe	40
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1172 wrote to memory of 1880	1172	svchost.exe	41
PID 1880 wrote to memory of 1100	1880	Setup.exe	42
PID 1880 wrote to memory of 1100	1880	Setup.exe	42
PID 1880 wrote to memory of 1100	1880	Setup.exe	42
PID 1880 wrote to memory of 1100	1880	Setup.exe	42

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:984
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpFF94.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1396
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - UAC bypass
    - Sets service image path in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1184
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:1016
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:1680
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:1616
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:1840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 304
        5⤵
        Program crash
        
        PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFF94.tmp.bat

Filesize
151B

MD5
7fadc9d03648a764c5aa2a9500bd2670

SHA1
47c100e80fd7f7183b0f149e2c25693d1efb12b4

SHA256
eb67b22a4ca5007139532597ae1bb947b487fb528bd82a29195dd5fefd557c25

SHA512
2595211272af5bf0a29124240e432e6a291df51a49bd22ebc5575be1babd67803a2ec2440653446779ea18ee97e53f36167580b774303d841174a5d58ef4365a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF94.tmp.bat

Filesize
151B

MD5
7fadc9d03648a764c5aa2a9500bd2670

SHA1
47c100e80fd7f7183b0f149e2c25693d1efb12b4

SHA256
eb67b22a4ca5007139532597ae1bb947b487fb528bd82a29195dd5fefd557c25

SHA512
2595211272af5bf0a29124240e432e6a291df51a49bd22ebc5575be1babd67803a2ec2440653446779ea18ee97e53f36167580b774303d841174a5d58ef4365a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
336KB

MD5
7f5fd6228a8d8edf2c88d1b34cb8c847

SHA1
408049adf245bcad778add0903c6803a4d691d3f

SHA256
2869fbcf083c03c7cd55e45661f6df089fdf169b1719d5052a52e2e386bf3a6d

SHA512
4ec90147cdace22b9a14d776fe28837994689553aeef682597a4e218a44ca68a0227131987ed28f6458ca6ba478f2e1f39785f99c98154a301a5affb37a755ab

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
336KB

MD5
7f5fd6228a8d8edf2c88d1b34cb8c847

SHA1
408049adf245bcad778add0903c6803a4d691d3f

SHA256
2869fbcf083c03c7cd55e45661f6df089fdf169b1719d5052a52e2e386bf3a6d

SHA512
4ec90147cdace22b9a14d776fe28837994689553aeef682597a4e218a44ca68a0227131987ed28f6458ca6ba478f2e1f39785f99c98154a301a5affb37a755ab

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
336KB

MD5
7f5fd6228a8d8edf2c88d1b34cb8c847

SHA1
408049adf245bcad778add0903c6803a4d691d3f

SHA256
2869fbcf083c03c7cd55e45661f6df089fdf169b1719d5052a52e2e386bf3a6d

SHA512
4ec90147cdace22b9a14d776fe28837994689553aeef682597a4e218a44ca68a0227131987ed28f6458ca6ba478f2e1f39785f99c98154a301a5affb37a755ab

Download Submit
memory/624-55-0x000000001BF70000-0x000000001BFF0000-memory.dmp

Filesize
512KB

Download
memory/624-54-0x0000000000E60000-0x0000000000EB8000-memory.dmp

Filesize
352KB

Download
memory/1172-69-0x0000000000150000-0x00000000001A8000-memory.dmp

Filesize
352KB

Download
memory/1172-70-0x000000001BE20000-0x000000001BEA0000-memory.dmp

Filesize
512KB

Download
memory/1184-76-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/1184-77-0x0000000002420000-0x0000000002428000-memory.dmp

Filesize
32KB

Download
memory/1184-78-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/1184-79-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/1184-80-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/1880-81-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download