asyncrat | 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c

Resubmissions

21/11/2023, 16:11

231121-tmwtlafe8410

21/11/2023, 16:10

21/11/2023, 16:10

21/11/2023, 16:08

21/11/2023, 16:08

21/11/2023, 16:08

Analysis

max time kernel
1682s
max time network
1138s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vanta.exe
Size 2.5MB
Sample231121-tmwtlafe84
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3232
2.56.245.187:3232

Mutex

西rXm9HV5FnΙ开YRmi1

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000720000-0x0000000000736000-memory.dmp	asyncrat
behavioral2/files/0x0006000000022ce9-12.dat	asyncrat
behavioral2/files/0x0006000000022ce9-13.dat	asyncrat
behavioral2/memory/4108-20-0x000000001E170000-0x000000001E222000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	Vanta.exe

Executes dropped EXE 1 IoCs

pid	Process
4108	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4076	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5080	timeout.exe
1704	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe
3968	Vanta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	Vanta.exe
Token: SeDebugPrivilege	4108	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1144	3968	Vanta.exe	91
PID 3968 wrote to memory of 1144	3968	Vanta.exe	91
PID 3968 wrote to memory of 884	3968	Vanta.exe	93
PID 3968 wrote to memory of 884	3968	Vanta.exe	93
PID 884 wrote to memory of 5080	884	cmd.exe	96
PID 884 wrote to memory of 5080	884	cmd.exe	96
PID 1144 wrote to memory of 4076	1144	cmd.exe	95
PID 1144 wrote to memory of 4076	1144	cmd.exe	95
PID 884 wrote to memory of 4108	884	cmd.exe	97
PID 884 wrote to memory of 4108	884	cmd.exe	97
PID 4108 wrote to memory of 2956	4108	svchost.exe	107
PID 4108 wrote to memory of 2956	4108	svchost.exe	107
PID 4108 wrote to memory of 4412	4108	svchost.exe	109
PID 4108 wrote to memory of 4412	4108	svchost.exe	109
PID 2956 wrote to memory of 3280	2956	cmd.exe	111
PID 2956 wrote to memory of 3280	2956	cmd.exe	111
PID 4412 wrote to memory of 1704	4412	cmd.exe	112
PID 4412 wrote to memory of 1704	4412	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vanta.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp11BE.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5080
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "svchost"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "svchost"
        5⤵
        
        PID:3280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9DB2.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp11BE.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp11BE.tmp.bat
Size 151B
SHA256 d4c93002f79575671851f6b187fcff74326eb1feeb2100df9b74a4d75674818b
MD5 9d7e10d3a8178036ec674e25f0c08073
SHA1 633b6a7eac24123018b9e2953b1187ca92642a34
SHA512 79e6d9c2370f4177d626f9abe673282140582d784d559a82b44c67b42ac39c30e180fbcde8873e5443ce6f0b8380f8bd8dfae20d1640744506d0e837ae135931
MD5 SHA1 SHA512

Submit Download

tmp9DB2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9DB2.tmp.bat
Size 156B
SHA256 07502da557ac1cadb846c078c16c59daf0cd642e4dacb49472d04e718537f73b
MD5 68618eed53b1fdc6f15847e71bbf4434
SHA1 a25174704865f93cd243cd62e50bb6cfcada2e88
SHA512 09de5dab6cf73ac113642bdfa7dc124eb85cdad6a326ebf1242e2b4aca27dffd2a7ec8066b95d58ba3f88dce6c52676c2c4d7e9c8b841b96f5fd651610927572
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 2.5MB
SHA256 31283efe572fee109e86b73f1718e69387fc7ea14e59c8bad26621e599fd050c
MD5 2b9ec7f6f4cf6b33327e851b1874e314
SHA1 08b7b7bee63c54419d2a0f5ea9ed327c877b2ea9
SHA512 89bb9bce6223b4376932ee5fc5d7e06d11f874df73f93a4b11bc347985492efa39f30188e1885e16ce3a3fee6d9ef8a3aceea4eecf9573e0de307ed107317309
SSDEEP 1536:DeQPc25j5BnihYUbfh9pfFeJuMdpqKmY7:DeDY9BnaYUbfNfkvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3968-8-0x00007FFA121A0000-0x00007FFA12C61000-memory.dmp

Download

memory/3968-9-0x00007FFA260F0000-0x00007FFA262E5000-memory.dmp

Download

memory/3968-0-0x0000000000720000-0x0000000000736000-memory.dmp

Download

memory/3968-3-0x00007FFA260F0000-0x00007FFA262E5000-memory.dmp

Download

memory/3968-2-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

Download

memory/3968-1-0x00007FFA121A0000-0x00007FFA12C61000-memory.dmp

Download

memory/4108-18-0x00007FFA12080000-0x00007FFA12B41000-memory.dmp

Download

memory/4108-15-0x00007FFA260F0000-0x00007FFA262E5000-memory.dmp

Download

memory/4108-19-0x000000001E0F0000-0x000000001E166000-memory.dmp

Download

memory/4108-20-0x000000001E170000-0x000000001E222000-memory.dmp

Download

memory/4108-21-0x000000001E340000-0x000000001E35E000-memory.dmp

Download

memory/4108-14-0x00007FFA12080000-0x00007FFA12B41000-memory.dmp

Download

memory/4108-26-0x00007FFA12080000-0x00007FFA12B41000-memory.dmp

Download

memory/4108-27-0x00007FFA260F0000-0x00007FFA262E5000-memory.dmp

Download