asyncrat | fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44

Analysis

max time kernel
109s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Purchase Order SSRNSSIQ102-2023.exe
Size 787KB
Sample230609-hfr2aabb56
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
logs.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/1468-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1468-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1468-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1468-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1468-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1468-73-0x0000000000760000-0x00000000007A0000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1400	logs.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1976	schtasks.exe
1860	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1432	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1160	New Purchase Order SSRNSSIQ102-2023.exe
1468	New Purchase Order SSRNSSIQ102-2023.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	New Purchase Order SSRNSSIQ102-2023.exe
Token: SeDebugPrivilege	1468	New Purchase Order SSRNSSIQ102-2023.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1976	1160	New Purchase Order SSRNSSIQ102-2023.exe	27
PID 1160 wrote to memory of 1976	1160	New Purchase Order SSRNSSIQ102-2023.exe	27
PID 1160 wrote to memory of 1976	1160	New Purchase Order SSRNSSIQ102-2023.exe	27
PID 1160 wrote to memory of 1976	1160	New Purchase Order SSRNSSIQ102-2023.exe	27
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1160 wrote to memory of 1468	1160	New Purchase Order SSRNSSIQ102-2023.exe	29
PID 1468 wrote to memory of 876	1468	New Purchase Order SSRNSSIQ102-2023.exe	30
PID 1468 wrote to memory of 876	1468	New Purchase Order SSRNSSIQ102-2023.exe	30
PID 1468 wrote to memory of 876	1468	New Purchase Order SSRNSSIQ102-2023.exe	30
PID 1468 wrote to memory of 876	1468	New Purchase Order SSRNSSIQ102-2023.exe	30
PID 1468 wrote to memory of 1696	1468	New Purchase Order SSRNSSIQ102-2023.exe	31
PID 1468 wrote to memory of 1696	1468	New Purchase Order SSRNSSIQ102-2023.exe	31
PID 1468 wrote to memory of 1696	1468	New Purchase Order SSRNSSIQ102-2023.exe	31
PID 1468 wrote to memory of 1696	1468	New Purchase Order SSRNSSIQ102-2023.exe	31
PID 1696 wrote to memory of 1432	1696	cmd.exe	34
PID 1696 wrote to memory of 1432	1696	cmd.exe	34
PID 1696 wrote to memory of 1432	1696	cmd.exe	34
PID 1696 wrote to memory of 1432	1696	cmd.exe	34
PID 876 wrote to memory of 1860	876	cmd.exe	35
PID 876 wrote to memory of 1860	876	cmd.exe	35
PID 876 wrote to memory of 1860	876	cmd.exe	35
PID 876 wrote to memory of 1860	876	cmd.exe	35
PID 1696 wrote to memory of 1400	1696	cmd.exe	36
PID 1696 wrote to memory of 1400	1696	cmd.exe	36
PID 1696 wrote to memory of 1400	1696	cmd.exe	36
PID 1696 wrote to memory of 1400	1696	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe
"C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F59.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1432
  - - C:\Users\Admin\AppData\Roaming\logs.exe
      "C:\Users\Admin\AppData\Roaming\logs.exe"
      4⤵
      Executes dropped EXE
      PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4F59.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4F59.tmp
Size 1KB
SHA256 4c63cd0b1d6f321bc226675ff6ad648dfa189c90e9148356a153fc7d878d1848
MD5 6074005ed1284edb1e38178d5ee5c6e9
SHA1 a041c285515da3c877ab0bc6c9a43490d05d020d
SHA512 e9c3492d3b8996b78ed15ddce2d3c16bb514e7c32945d100614345200ca5e49ead93f07b58a45752aeeb54081d439882b2fb078d9b43edd35140d1e540b72b3c
MD5 SHA1 SHA512

Submit Download

tmp6A19.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat
Size 148B
SHA256 b702137e320685790ef6555ef2f165f3848dd5b36600c63aeca4402865796817
MD5 f3e88dbe42eac2672ad4329fc29d0b35
SHA1 5e82ea517af4edc953b0ce8d2f6ff47c2ec628d1
SHA512 943d0e7652af0a5e43a620e577b0bdeec471ee7cbad2473d8cc2fb6d388e37030c24b65b1d00cfcae58fc8b726fb392e100b6f0969fb07e0f24c7412070725e7
MD5 SHA1 SHA512

Submit Download

tmp6A19.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat
Size 148B
SHA256 b702137e320685790ef6555ef2f165f3848dd5b36600c63aeca4402865796817
MD5 f3e88dbe42eac2672ad4329fc29d0b35
SHA1 5e82ea517af4edc953b0ce8d2f6ff47c2ec628d1
SHA512 943d0e7652af0a5e43a620e577b0bdeec471ee7cbad2473d8cc2fb6d388e37030c24b65b1d00cfcae58fc8b726fb392e100b6f0969fb07e0f24c7412070725e7
MD5 SHA1 SHA512

Submit Download

logs.exe

Path C:\Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.exe

Path C:\Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.exe

Path \Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1160-56-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/1160-59-0x0000000000710000-0x0000000000722000-memory.dmp

Download

memory/1160-57-0x0000000000250000-0x0000000000264000-memory.dmp

Download

memory/1160-58-0x0000000002250000-0x00000000022B6000-memory.dmp

Download

memory/1160-54-0x0000000000B20000-0x0000000000BEC000-memory.dmp

Download

memory/1160-55-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/1400-88-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/1400-87-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/1400-86-0x0000000000DD0000-0x0000000000E9C000-memory.dmp

Download

memory/1468-65-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-73-0x0000000000760000-0x00000000007A0000-memory.dmp

Download

memory/1468-72-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-70-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-68-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1468-66-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-64-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1468-63-0x0000000000400000-0x0000000000412000-memory.dmp

Download