asyncrat | 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c

Resubmissions

21/11/2023, 16:11

231121-tmwtlafe8410

21/11/2023, 16:10

21/11/2023, 16:10

21/11/2023, 16:08

21/11/2023, 16:08

21/11/2023, 16:08

Analysis

max time kernel
1664s
max time network
1140s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vanta.exe
Size 2.5MB
Sample231121-tmr6eafe82
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3232
2.56.245.187:3232

Mutex

西rXm9HV5FnΙ开YRmi1

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2040-0-0x0000000000910000-0x0000000000926000-memory.dmp	asyncrat
behavioral2/files/0x0008000000022d5a-12.dat	asyncrat
behavioral2/files/0x0008000000022d5a-13.dat	asyncrat
behavioral2/memory/4116-20-0x000000001E9F0000-0x000000001EAA2000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	Vanta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4116	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4660	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4736	timeout.exe
2612	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe
2040	Vanta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	Vanta.exe
Token: SeDebugPrivilege	4116	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 824	2040	Vanta.exe	89
PID 2040 wrote to memory of 824	2040	Vanta.exe	89
PID 2040 wrote to memory of 1960	2040	Vanta.exe	91
PID 2040 wrote to memory of 1960	2040	Vanta.exe	91
PID 824 wrote to memory of 4660	824	cmd.exe	94
PID 824 wrote to memory of 4660	824	cmd.exe	94
PID 1960 wrote to memory of 4736	1960	cmd.exe	93
PID 1960 wrote to memory of 4736	1960	cmd.exe	93
PID 1960 wrote to memory of 4116	1960	cmd.exe	97
PID 1960 wrote to memory of 4116	1960	cmd.exe	97
PID 4116 wrote to memory of 3128	4116	svchost.exe	102
PID 4116 wrote to memory of 3128	4116	svchost.exe	102
PID 4116 wrote to memory of 740	4116	svchost.exe	104
PID 4116 wrote to memory of 740	4116	svchost.exe	104
PID 3128 wrote to memory of 404	3128	cmd.exe	107
PID 3128 wrote to memory of 404	3128	cmd.exe	107
PID 740 wrote to memory of 2612	740	cmd.exe	106
PID 740 wrote to memory of 2612	740	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vanta.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp318.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4736
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "svchost"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "svchost"
        5⤵
        
        PID:404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp773E.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp318.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp318.tmp.bat
Size 150B
SHA256 f81384d1fbd39551021c5745000437921ca2fe466af93c47d18ea64721e90e6e
MD5 ba1dc3b8c3d9b259f051a34a231c254d
SHA1 f94a96912cb19be048b51e02b8833258147b4357
SHA512 dbca454fc4cd0228e5f2446abc9d8c7b9e99e61b2eb81a76380e05b26e12f3813510ab319716dd28ec9047ab2233e08f0987deac47dff99b34383ad53dcb2ccc
MD5 SHA1 SHA512

Submit Download

tmp773E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp773E.tmp.bat
Size 156B
SHA256 909ee3cfdf2535f454f73199687c78ae0c4c76147fdf75f943ce01042afecbd9
MD5 41a4dca48f53185c1c938d91673bb59b
SHA1 d319647b8443266f2cd3b4f1a451a53c6fbb882d
SHA512 b2cbc5fb101f931bcf5a183c2ca797c840d7ca7b89a080cfc36f1207b560eb2403bebd777369cab65a578e004bfcf2475052de8f090e0b98175f0a263e14c8ce
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-8-0x00007FFCD8360000-0x00007FFCD8E21000-memory.dmp

Download

memory/2040-9-0x00007FFCF6370000-0x00007FFCF6565000-memory.dmp

Download

memory/2040-0-0x0000000000910000-0x0000000000926000-memory.dmp

Download

memory/2040-7-0x00007FFCF6370000-0x00007FFCF6565000-memory.dmp

Download

memory/2040-2-0x000000001B620000-0x000000001B630000-memory.dmp

Download

memory/2040-1-0x00007FFCD8360000-0x00007FFCD8E21000-memory.dmp

Download

memory/4116-18-0x00007FFCD7C60000-0x00007FFCD8721000-memory.dmp

Download

memory/4116-17-0x00007FFCF6370000-0x00007FFCF6565000-memory.dmp

Download

memory/4116-19-0x000000001E970000-0x000000001E9E6000-memory.dmp

Download

memory/4116-20-0x000000001E9F0000-0x000000001EAA2000-memory.dmp

Download

memory/4116-21-0x000000001EBC0000-0x000000001EBDE000-memory.dmp

Download

memory/4116-25-0x00007FFCD7C60000-0x00007FFCD8721000-memory.dmp

Download

memory/4116-14-0x00007FFCD7C60000-0x00007FFCD8721000-memory.dmp

Download

memory/4116-27-0x00007FFCF6370000-0x00007FFCF6565000-memory.dmp

Download