Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 14:59
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20230220-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
11c12e50d5c5b0ae6578f770bfb41671
-
SHA1
87c61e6cad8bf6be174e087784bc5f204648ebe7
-
SHA256
e2be314cb5392f83e23694be4e43326f746e0067012a5f423d72b2ecc3bb1575
-
SHA512
b9c0a081c9c2efb87fc34877d508d0bc7a0504882fd04716535cfb6cea3e5dfe64e7ea834f444903de3f334d625f3a45c58508d68c6ee9853dd60d13e10f463a
-
SSDEEP
768:ju0OVTBRlc6nWUbmelmo2qjrKjGKG6PIyzjbFgX3i9PjHrVFvyrLxBDZjx:ju0OVTBnck26KYDy3bCXSpjHrVdyrrdd
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:15491
127.0.0.1:8080
195.78.54.247:15491
195.78.54.247:8080
2.tcp.eu.ngrok.io:15491
2.tcp.eu.ngrok.io:8080
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
awdawd.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1688-133-0x0000000000E30000-0x0000000000E42000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\awdawd.exe asyncrat C:\Users\Admin\AppData\Roaming\awdawd.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
Processes:
awdawd.exepid process 4048 awdawd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3120 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
AsyncClient.exepid process 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe 1688 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AsyncClient.exeawdawd.exedescription pid process Token: SeDebugPrivilege 1688 AsyncClient.exe Token: SeDebugPrivilege 4048 awdawd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
AsyncClient.execmd.execmd.exedescription pid process target process PID 1688 wrote to memory of 3504 1688 AsyncClient.exe cmd.exe PID 1688 wrote to memory of 3504 1688 AsyncClient.exe cmd.exe PID 1688 wrote to memory of 3504 1688 AsyncClient.exe cmd.exe PID 1688 wrote to memory of 3772 1688 AsyncClient.exe cmd.exe PID 1688 wrote to memory of 3772 1688 AsyncClient.exe cmd.exe PID 1688 wrote to memory of 3772 1688 AsyncClient.exe cmd.exe PID 3504 wrote to memory of 2452 3504 cmd.exe schtasks.exe PID 3504 wrote to memory of 2452 3504 cmd.exe schtasks.exe PID 3504 wrote to memory of 2452 3504 cmd.exe schtasks.exe PID 3772 wrote to memory of 3120 3772 cmd.exe timeout.exe PID 3772 wrote to memory of 3120 3772 cmd.exe timeout.exe PID 3772 wrote to memory of 3120 3772 cmd.exe timeout.exe PID 3772 wrote to memory of 4048 3772 cmd.exe awdawd.exe PID 3772 wrote to memory of 4048 3772 cmd.exe awdawd.exe PID 3772 wrote to memory of 4048 3772 cmd.exe awdawd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "awdawd" /tr '"C:\Users\Admin\AppData\Roaming\awdawd.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "awdawd" /tr '"C:\Users\Admin\AppData\Roaming\awdawd.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8458.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\awdawd.exe"C:\Users\Admin\AppData\Roaming\awdawd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8458.tmp.batFilesize
150B
MD5c8fdbaa73bd957945e1dc5d97294da19
SHA152fd28d91bd56258655faa40d8eaf34ff8f8130c
SHA25691ec030875d748ce763994accf1837b36bf0a7c5b81d405f0633a8eb58cb27d7
SHA512177b6a8096a3a4616f4924347e5cf35edd7f835b44fc9cb4cf69575829771e7b236772366b2fee9815651263c98cd8ff57d4b1b8f022044ec32e921d05a545c5
-
C:\Users\Admin\AppData\Roaming\awdawd.exeFilesize
45KB
MD511c12e50d5c5b0ae6578f770bfb41671
SHA187c61e6cad8bf6be174e087784bc5f204648ebe7
SHA256e2be314cb5392f83e23694be4e43326f746e0067012a5f423d72b2ecc3bb1575
SHA512b9c0a081c9c2efb87fc34877d508d0bc7a0504882fd04716535cfb6cea3e5dfe64e7ea834f444903de3f334d625f3a45c58508d68c6ee9853dd60d13e10f463a
-
C:\Users\Admin\AppData\Roaming\awdawd.exeFilesize
45KB
MD511c12e50d5c5b0ae6578f770bfb41671
SHA187c61e6cad8bf6be174e087784bc5f204648ebe7
SHA256e2be314cb5392f83e23694be4e43326f746e0067012a5f423d72b2ecc3bb1575
SHA512b9c0a081c9c2efb87fc34877d508d0bc7a0504882fd04716535cfb6cea3e5dfe64e7ea834f444903de3f334d625f3a45c58508d68c6ee9853dd60d13e10f463a
-
memory/1688-133-0x0000000000E30000-0x0000000000E42000-memory.dmpFilesize
72KB
-
memory/1688-134-0x00000000032A0000-0x00000000032B0000-memory.dmpFilesize
64KB
-
memory/1688-135-0x0000000005900000-0x000000000599C000-memory.dmpFilesize
624KB
-
memory/4048-144-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4048-145-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB