asyncrat | 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c

Resubmissions

21/11/2023, 16:11

231121-tm2pvagc5y10

21/11/2023, 16:08

231121-tk9bxafe7210

Analysis

max time kernel
1376s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vanta.exe
Size 2.5MB
Sample231121-tk9bxafe72
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3232
2.56.245.187:3232

Mutex

西rXm9HV5FnΙ开YRmi1

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1968-0-0x0000000000BF0000-0x0000000000C06000-memory.dmp	asyncrat
behavioral2/files/0x000200000002244d-11.dat	asyncrat
behavioral2/files/0x000200000002244d-12.dat	asyncrat
behavioral2/memory/4084-20-0x000000001DD70000-0x000000001DE22000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	Vanta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4084	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1160	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4688	timeout.exe
2724	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe
1968	Vanta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	Vanta.exe
Token: SeDebugPrivilege	4084	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 940	1968	Vanta.exe	91
PID 1968 wrote to memory of 940	1968	Vanta.exe	91
PID 1968 wrote to memory of 636	1968	Vanta.exe	93
PID 1968 wrote to memory of 636	1968	Vanta.exe	93
PID 940 wrote to memory of 1160	940	cmd.exe	95
PID 940 wrote to memory of 1160	940	cmd.exe	95
PID 636 wrote to memory of 4688	636	cmd.exe	96
PID 636 wrote to memory of 4688	636	cmd.exe	96
PID 636 wrote to memory of 4084	636	cmd.exe	99
PID 636 wrote to memory of 4084	636	cmd.exe	99
PID 4084 wrote to memory of 4840	4084	svchost.exe	116
PID 4084 wrote to memory of 4840	4084	svchost.exe	116
PID 4084 wrote to memory of 5088	4084	svchost.exe	118
PID 4084 wrote to memory of 5088	4084	svchost.exe	118
PID 4840 wrote to memory of 3232	4840	cmd.exe	120
PID 4840 wrote to memory of 3232	4840	cmd.exe	120
PID 5088 wrote to memory of 2724	5088	cmd.exe	121
PID 5088 wrote to memory of 2724	5088	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vanta.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8964.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4688
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "svchost"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "svchost"
        5⤵
        
        PID:3232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC5EB.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8964.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8964.tmp.bat
Size 151B
SHA256 d2661d5cfde93d38657813c53cbe73a3d4e43c2ad69414cf9876104c2321727f
MD5 2338edc4400d81fbba9c4bf31cc31944
SHA1 16c0fd357506422117bc2263b35290f6b7d68bc9
SHA512 8089c4ce58261abb02d9ecf9dd59fe28a04bcdc44ec6f11b958526011e70e33c79105b84820ea430f1fab344617b8a1380eb7f9b3084bf244bd6bdc88fc8cff8
MD5 SHA1 SHA512

Submit Download

tmpC5EB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC5EB.tmp.bat
Size 156B
SHA256 dcdce6a071f6de3f190046aa0fd5907324f2b5af6874ee5ac17ec112d1911f42
MD5 1b34e51af0184169350384173f07e980
SHA1 b3b9108dad35b62237b79bdac8da887d119d5262
SHA512 e93ea33d7d4cc80fa825769d04c3c7d3f5ad1ef14cb953692458c794dcf6d35543d0a528f7dd9279cb9d784f35a2e65ddb629e0c32fec1462faa4cfc7aebb0ee
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1968-1-0x00007FFD534A0000-0x00007FFD53F61000-memory.dmp

Download

memory/1968-2-0x000000001B8B0000-0x000000001B8C0000-memory.dmp

Download

memory/1968-7-0x00007FFD71FF0000-0x00007FFD721E5000-memory.dmp

Download

memory/1968-8-0x00007FFD534A0000-0x00007FFD53F61000-memory.dmp

Download

memory/1968-0-0x0000000000BF0000-0x0000000000C06000-memory.dmp

Download

memory/4084-13-0x00007FFD53170000-0x00007FFD53C31000-memory.dmp

Download

memory/4084-17-0x00007FFD53170000-0x00007FFD53C31000-memory.dmp

Download

memory/4084-18-0x00007FFD71FF0000-0x00007FFD721E5000-memory.dmp

Download

memory/4084-19-0x000000001DCF0000-0x000000001DD66000-memory.dmp

Download

memory/4084-20-0x000000001DD70000-0x000000001DE22000-memory.dmp

Download

memory/4084-21-0x000000001DF40000-0x000000001DF5E000-memory.dmp

Download

memory/4084-25-0x00007FFD53170000-0x00007FFD53C31000-memory.dmp

Download

memory/4084-26-0x00007FFD71FF0000-0x00007FFD721E5000-memory.dmp

Download

memory/4084-14-0x00007FFD71FF0000-0x00007FFD721E5000-memory.dmp

Download