asyncrat | fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2023, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Purchase Order SSRNSSIQ102-2023.exe
Size 787KB
Sample230609-hfr2aabb56
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
logs.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3936-144-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	New Purchase Order SSRNSSIQ102-2023.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	New Purchase Order SSRNSSIQ102-2023.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	logs.exe

Executes dropped EXE 2 IoCs

pid	Process
4356	logs.exe
3012	logs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 264 set thread context of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 4356 set thread context of 3012	4356	logs.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2900	schtasks.exe
3280	schtasks.exe
2092	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4672	timeout.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
264	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
3936	New Purchase Order SSRNSSIQ102-2023.exe
4356	logs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	264	New Purchase Order SSRNSSIQ102-2023.exe
Token: SeDebugPrivilege	3936	New Purchase Order SSRNSSIQ102-2023.exe
Token: SeDebugPrivilege	4356	logs.exe
Token: SeDebugPrivilege	3012	logs.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2900	264	New Purchase Order SSRNSSIQ102-2023.exe	89
PID 264 wrote to memory of 2900	264	New Purchase Order SSRNSSIQ102-2023.exe	89
PID 264 wrote to memory of 2900	264	New Purchase Order SSRNSSIQ102-2023.exe	89
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 264 wrote to memory of 3936	264	New Purchase Order SSRNSSIQ102-2023.exe	91
PID 3936 wrote to memory of 4164	3936	New Purchase Order SSRNSSIQ102-2023.exe	92
PID 3936 wrote to memory of 4164	3936	New Purchase Order SSRNSSIQ102-2023.exe	92
PID 3936 wrote to memory of 4164	3936	New Purchase Order SSRNSSIQ102-2023.exe	92
PID 3936 wrote to memory of 3296	3936	New Purchase Order SSRNSSIQ102-2023.exe	94
PID 3936 wrote to memory of 3296	3936	New Purchase Order SSRNSSIQ102-2023.exe	94
PID 3936 wrote to memory of 3296	3936	New Purchase Order SSRNSSIQ102-2023.exe	94
PID 4164 wrote to memory of 3280	4164	cmd.exe	97
PID 4164 wrote to memory of 3280	4164	cmd.exe	97
PID 4164 wrote to memory of 3280	4164	cmd.exe	97
PID 3296 wrote to memory of 4672	3296	cmd.exe	96
PID 3296 wrote to memory of 4672	3296	cmd.exe	96
PID 3296 wrote to memory of 4672	3296	cmd.exe	96
PID 3296 wrote to memory of 4356	3296	cmd.exe	98
PID 3296 wrote to memory of 4356	3296	cmd.exe	98
PID 3296 wrote to memory of 4356	3296	cmd.exe	98
PID 4356 wrote to memory of 2092	4356	logs.exe	99
PID 4356 wrote to memory of 2092	4356	logs.exe	99
PID 4356 wrote to memory of 2092	4356	logs.exe	99
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101
PID 4356 wrote to memory of 3012	4356	logs.exe	101

C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe
"C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD95.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\New Purchase Order SSRNSSIQ102-2023.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "logs" /tr '"C:\Users\Admin\AppData\Roaming\logs.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC98A.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4672
  - - C:\Users\Admin\AppData\Roaming\logs.exe
      "C:\Users\Admin\AppData\Roaming\logs.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2092
    - - C:\Users\Admin\AppData\Roaming\logs.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

New Purchase Order SSRNSSIQ102-2023.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Purchase Order SSRNSSIQ102-2023.exe.log
Size 1KB
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
MD5 SHA1 SHA512

Submit Download

tmp79BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp
Size 1KB
SHA256 eabeb35837c8a540b452adbf021e27dca5eb07e960708af679863279a3f66398
MD5 de078d073c4ac051385bb326943337a9
SHA1 e779dc9a3b09613d4b87d6b2d6e771a35d8f243d
SHA512 2673e56a84265942bac03940c9c641c8514e90e4aad8971f9f7cd0a72e64b3861c52261ac045434c6db1f8079479dc990c969d188026f90507289e5c670dfd77
MD5 SHA1 SHA512

Submit Download

tmpAD95.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAD95.tmp
Size 1KB
SHA256 eabeb35837c8a540b452adbf021e27dca5eb07e960708af679863279a3f66398
MD5 de078d073c4ac051385bb326943337a9
SHA1 e779dc9a3b09613d4b87d6b2d6e771a35d8f243d
SHA512 2673e56a84265942bac03940c9c641c8514e90e4aad8971f9f7cd0a72e64b3861c52261ac045434c6db1f8079479dc990c969d188026f90507289e5c670dfd77
MD5 SHA1 SHA512

Submit Download

tmpC98A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC98A.tmp.bat
Size 148B
SHA256 cab0003d87c607cdb0103a926446994d2c3cd866425cc772eed9aad82ba220a2
MD5 39bb57ef87e4e9ad0b3e272c91d69cbc
SHA1 cc3496bb43da906e8f2b946994ab4f6e5af2aa26
SHA512 b786f5ad2378f4e8dd9b35d4db114e0ccc0dc0f0d88839542e720c675f61f1e6bfc10480e4f7f9852475d178cd0bef48a9f8225fa3d43aba55286f599ecb7468
MD5 SHA1 SHA512

Submit Download

logs.exe

Path C:\Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.exe

Path C:\Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.exe

Path C:\Users\Admin\AppData\Roaming\logs.exe
Size 787KB
SHA256 fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
MD5 0e6861c721b9342f69eba894703f6484
SHA1 6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
SHA512 6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
SSDEEP 6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/264-138-0x0000000005A10000-0x0000000005A66000-memory.dmp

Download

memory/264-135-0x0000000005E80000-0x0000000006424000-memory.dmp

Download

memory/264-134-0x0000000005830000-0x00000000058CC000-memory.dmp

Download

memory/264-139-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Download

memory/264-140-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Download

memory/264-133-0x0000000000DE0000-0x0000000000EAC000-memory.dmp

Download

memory/264-137-0x0000000005900000-0x000000000590A000-memory.dmp

Download

memory/264-136-0x0000000005970000-0x0000000005A02000-memory.dmp

Download

memory/3012-162-0x0000000005810000-0x0000000005820000-memory.dmp

Download

memory/3012-163-0x0000000005C10000-0x0000000005C76000-memory.dmp

Download

memory/3012-164-0x0000000005810000-0x0000000005820000-memory.dmp

Download

memory/3936-147-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/3936-144-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4356-155-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/4356-156-0x0000000005330000-0x0000000005340000-memory.dmp

Download