asyncrat | 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c

Resubmissions

21/11/2023, 16:11

231121-tmwtlafe8410

21/11/2023, 16:10

21/11/2023, 16:10

21/11/2023, 16:08

21/11/2023, 16:08

21/11/2023, 16:08

Analysis

max time kernel
1344s
max time network
1137s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vanta.exe
Size 2.5MB
Sample231121-tlpc5agc4x
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3232
2.56.245.187:3232

Mutex

西rXm9HV5FnΙ开YRmi1

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/1528-0-0x0000000000E30000-0x0000000000E46000-memory.dmp	asyncrat
behavioral2/memory/1528-2-0x000000001BBB0000-0x000000001BBC0000-memory.dmp	asyncrat
behavioral2/files/0x0008000000022d7c-12.dat	asyncrat
behavioral2/files/0x0008000000022d7c-13.dat	asyncrat
behavioral2/memory/3200-20-0x000000001DC20000-0x000000001DCD2000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	Vanta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3200	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3524	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2444	timeout.exe
2336	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe
1528	Vanta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	Vanta.exe
Token: SeDebugPrivilege	3200	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3572	1528	Vanta.exe	89
PID 1528 wrote to memory of 3572	1528	Vanta.exe	89
PID 1528 wrote to memory of 5096	1528	Vanta.exe	91
PID 1528 wrote to memory of 5096	1528	Vanta.exe	91
PID 3572 wrote to memory of 3524	3572	cmd.exe	93
PID 3572 wrote to memory of 3524	3572	cmd.exe	93
PID 5096 wrote to memory of 2444	5096	cmd.exe	94
PID 5096 wrote to memory of 2444	5096	cmd.exe	94
PID 5096 wrote to memory of 3200	5096	cmd.exe	97
PID 5096 wrote to memory of 3200	5096	cmd.exe	97
PID 3200 wrote to memory of 2964	3200	svchost.exe	102
PID 3200 wrote to memory of 2964	3200	svchost.exe	102
PID 3200 wrote to memory of 1624	3200	svchost.exe	104
PID 3200 wrote to memory of 1624	3200	svchost.exe	104
PID 2964 wrote to memory of 2352	2964	cmd.exe	106
PID 2964 wrote to memory of 2352	2964	cmd.exe	106
PID 1624 wrote to memory of 2336	1624	cmd.exe	107
PID 1624 wrote to memory of 2336	1624	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vanta.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp829.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2444
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "svchost"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "svchost"
        5⤵
        
        PID:2352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7BC3.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7BC3.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7BC3.tmp.bat
Size 156B
SHA256 afe285e31527814d9f7b9262d003f6f55abd3773eea73539849cbecdfb62a9d8
MD5 7c4c7218fb93019f0d655cc5d981ec97
SHA1 420c541d7e1b19efe6613daf5c6045ee5d473c51
SHA512 587eb2705a5647e741a26d65cb450d03861956635478b3eba3b42220f96fccd0b9957d7ea1048ad0dacfaf169655ca17e563a494810d9f7bcea14c815d94a2fe
MD5 SHA1 SHA512

Submit Download

tmp829.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp829.tmp.bat
Size 150B
SHA256 bc05af7b7a36dd3ce9d8c4ade0ceebdf36cf65df94f86f76f5a4503711c7d4c7
MD5 cdaacf79e8a8799ec5aa1dfcaa75d7d9
SHA1 c0f736c1bef69f4cf9cbb3a85678e7239a232a0f
SHA512 5bab8f26a70780505a63575eacf3a6d4b1f8c73b40fd9304db1c8198feff6c75271b9288e5f3d430f9f2cc7aab80fc80df41309c581e7a3bc69465af2563a820
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1528-8-0x00007FFE05DB0000-0x00007FFE06871000-memory.dmp

Download

memory/1528-9-0x00007FFE23950000-0x00007FFE23B45000-memory.dmp

Download

memory/1528-0-0x0000000000E30000-0x0000000000E46000-memory.dmp

Download

memory/1528-7-0x00007FFE23950000-0x00007FFE23B45000-memory.dmp

Download

memory/1528-2-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/1528-1-0x00007FFE05DB0000-0x00007FFE06871000-memory.dmp

Download

memory/3200-18-0x00007FFE055A0000-0x00007FFE06061000-memory.dmp

Download

memory/3200-17-0x00007FFE23950000-0x00007FFE23B45000-memory.dmp

Download

memory/3200-19-0x000000001DBA0000-0x000000001DC16000-memory.dmp

Download

memory/3200-20-0x000000001DC20000-0x000000001DCD2000-memory.dmp

Download

memory/3200-21-0x000000001DDF0000-0x000000001DE0E000-memory.dmp

Download

memory/3200-25-0x00007FFE23950000-0x00007FFE23B45000-memory.dmp

Download

memory/3200-26-0x00007FFE055A0000-0x00007FFE06061000-memory.dmp

Download

memory/3200-14-0x00007FFE055A0000-0x00007FFE06061000-memory.dmp

Download