Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 14:40
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20230220-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
d804dbbb439098de1ef46b54b69519d8
-
SHA1
349a6c7e516dd41f2e164d305ca9168bef949072
-
SHA256
6a08cf2d6510da2ac1d951be0fd0d0796dc5c04d4e42727924ecef10b6115125
-
SHA512
d238601108a7ce8373ab1dcb611b67f729b7968853ab9fbd0cc85615c25dc6bb665ec1044fdef217ada5d8fb3422b1f021727d2759f7f385386d296d06de87ec
-
SSDEEP
768:7u1a21T3EiJfWUzuydmo2qzDKjGKG6PIyzjbFgX3iFt4k24EfYDJfp4XIlAKKyBv:7u1a21T3xN2SKYDy3bCXSIQ8YDJfpNdF
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:23092
195.78.54.247:23092
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
awdawd.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/404-133-0x00000000005F0000-0x0000000000602000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\awdawd.exe asyncrat C:\Users\Admin\AppData\Roaming\awdawd.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
Processes:
awdawd.exepid process 4632 awdawd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1296 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exeAsyncClient.exepid process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 404 AsyncClient.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4168 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exeAsyncClient.exeawdawd.exedescription pid process Token: SeDebugPrivilege 4168 taskmgr.exe Token: SeSystemProfilePrivilege 4168 taskmgr.exe Token: SeCreateGlobalPrivilege 4168 taskmgr.exe Token: SeDebugPrivilege 404 AsyncClient.exe Token: SeDebugPrivilege 4632 awdawd.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
AsyncClient.execmd.execmd.exedescription pid process target process PID 404 wrote to memory of 2140 404 AsyncClient.exe cmd.exe PID 404 wrote to memory of 2140 404 AsyncClient.exe cmd.exe PID 404 wrote to memory of 2140 404 AsyncClient.exe cmd.exe PID 404 wrote to memory of 236 404 AsyncClient.exe cmd.exe PID 404 wrote to memory of 236 404 AsyncClient.exe cmd.exe PID 404 wrote to memory of 236 404 AsyncClient.exe cmd.exe PID 2140 wrote to memory of 1004 2140 cmd.exe schtasks.exe PID 2140 wrote to memory of 1004 2140 cmd.exe schtasks.exe PID 2140 wrote to memory of 1004 2140 cmd.exe schtasks.exe PID 236 wrote to memory of 1296 236 cmd.exe timeout.exe PID 236 wrote to memory of 1296 236 cmd.exe timeout.exe PID 236 wrote to memory of 1296 236 cmd.exe timeout.exe PID 236 wrote to memory of 4632 236 cmd.exe awdawd.exe PID 236 wrote to memory of 4632 236 cmd.exe awdawd.exe PID 236 wrote to memory of 4632 236 cmd.exe awdawd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "awdawd" /tr '"C:\Users\Admin\AppData\Roaming\awdawd.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "awdawd" /tr '"C:\Users\Admin\AppData\Roaming\awdawd.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8012.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\awdawd.exe"C:\Users\Admin\AppData\Roaming\awdawd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8012.tmp.batFilesize
150B
MD52b680b675a3a0d5c5b71e30e3970ea35
SHA19e6178cda980ad5284162920178276194a064b5e
SHA256e6f353a5f3df0319edc1c366b45199f75999ba2f6d1295057909eb380cebbc97
SHA512dadaddfc84a052319c71cf4e6ec343a4a32bc849b5a03d70a8298bfac1a808257e36110825221dcc457659634d71083bd5f3a609ca7df7cb56069dbcd6585be0
-
C:\Users\Admin\AppData\Roaming\awdawd.exeFilesize
45KB
MD5d804dbbb439098de1ef46b54b69519d8
SHA1349a6c7e516dd41f2e164d305ca9168bef949072
SHA2566a08cf2d6510da2ac1d951be0fd0d0796dc5c04d4e42727924ecef10b6115125
SHA512d238601108a7ce8373ab1dcb611b67f729b7968853ab9fbd0cc85615c25dc6bb665ec1044fdef217ada5d8fb3422b1f021727d2759f7f385386d296d06de87ec
-
C:\Users\Admin\AppData\Roaming\awdawd.exeFilesize
45KB
MD5d804dbbb439098de1ef46b54b69519d8
SHA1349a6c7e516dd41f2e164d305ca9168bef949072
SHA2566a08cf2d6510da2ac1d951be0fd0d0796dc5c04d4e42727924ecef10b6115125
SHA512d238601108a7ce8373ab1dcb611b67f729b7968853ab9fbd0cc85615c25dc6bb665ec1044fdef217ada5d8fb3422b1f021727d2759f7f385386d296d06de87ec
-
memory/404-147-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/404-133-0x00000000005F0000-0x0000000000602000-memory.dmpFilesize
72KB
-
memory/404-148-0x0000000005120000-0x00000000051BC000-memory.dmpFilesize
624KB
-
memory/4168-140-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-143-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-144-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-145-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-146-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-142-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-141-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-136-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-134-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4168-135-0x0000024FF1CD0000-0x0000024FF1CD1000-memory.dmpFilesize
4KB
-
memory/4632-157-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB
-
memory/4632-158-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB