asyncrat | b29156030acc1b80de8d66c918e137a33cd1ee264f9695ec96be208cf5faf10b

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d9fb60e333f52c979bf29a3c945afc1.exe
Size

745KB
MD5

4d9fb60e333f52c979bf29a3c945afc1
SHA1

9ada995cab8a1bc55d436ece3b045c53f160eba1
SHA256

b29156030acc1b80de8d66c918e137a33cd1ee264f9695ec96be208cf5faf10b
SHA512

6e3b05a1385f92ceb71db215a0e34097bab33d362301ca11ed85c0e96bbe9cd529e7204ac1691e6c111f037bbe0e5da638d282253a57e57ab671bd38fb23c845
SSDEEP

12288:Xd+uc2PzR8VhO+J53diGSuosG5Pwkcb/dKkbHobkTNjfq42PwQAeitSM/dq7LMnF:XdlFrRkJ53diGSzsGlwRb/pJ9CmQY4MD

Score

10^/10

asyncrat zgrat persistence rat spyware stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 37 IoCs

resource	yara_rule
behavioral1/memory/2296-4-0x0000000000880000-0x0000000000932000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-5-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-6-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-10-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-8-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-12-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-14-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-16-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-22-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-20-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-24-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-18-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-28-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-26-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-30-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-32-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-34-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-36-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-38-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-40-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-42-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-46-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-48-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-44-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-54-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-52-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-50-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-62-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-64-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-66-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-60-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-58-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-68-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/2296-56-0x0000000000880000-0x000000000092D000-memory.dmp	family_zgrat_v1
behavioral1/memory/288-955-0x0000000000400000-0x000000000043C000-memory.dmp	family_zgrat_v1
behavioral1/memory/868-1923-0x0000000000400000-0x000000000043C000-memory.dmp	family_zgrat_v1
behavioral1/memory/868-1925-0x0000000004DA0000-0x0000000004DE0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/288-955-0x0000000000400000-0x000000000043C000-memory.dmp	asyncrat
behavioral1/memory/868-1923-0x0000000000400000-0x000000000043C000-memory.dmp	asyncrat
behavioral1/memory/868-1925-0x0000000004DA0000-0x0000000004DE0000-memory.dmp	asyncrat
behavioral1/memory/868-1943-0x0000000004DA0000-0x0000000004DE0000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2180	winhost.exe
868	winhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1064	cmd.exe
2180	winhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Upimbcgs = "C:\\Users\\Admin\\AppData\\Roaming\\Upimbcgs.exe"	4d9fb60e333f52c979bf29a3c945afc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Upimbcgs = "C:\\Users\\Admin\\AppData\\Roaming\\Upimbcgs.exe"	winhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2180 set thread context of 868	2180	winhost.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1344	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2692	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
288	4d9fb60e333f52c979bf29a3c945afc1.exe
288	4d9fb60e333f52c979bf29a3c945afc1.exe
868	winhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	4d9fb60e333f52c979bf29a3c945afc1.exe
Token: SeDebugPrivilege	288	4d9fb60e333f52c979bf29a3c945afc1.exe
Token: SeDebugPrivilege	2180	winhost.exe
Token: SeDebugPrivilege	868	winhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
868	winhost.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 2296 wrote to memory of 288	2296	4d9fb60e333f52c979bf29a3c945afc1.exe	28
PID 288 wrote to memory of 1656	288	4d9fb60e333f52c979bf29a3c945afc1.exe	29
PID 288 wrote to memory of 1656	288	4d9fb60e333f52c979bf29a3c945afc1.exe	29
PID 288 wrote to memory of 1656	288	4d9fb60e333f52c979bf29a3c945afc1.exe	29
PID 288 wrote to memory of 1656	288	4d9fb60e333f52c979bf29a3c945afc1.exe	29
PID 288 wrote to memory of 1064	288	4d9fb60e333f52c979bf29a3c945afc1.exe	31
PID 288 wrote to memory of 1064	288	4d9fb60e333f52c979bf29a3c945afc1.exe	31
PID 288 wrote to memory of 1064	288	4d9fb60e333f52c979bf29a3c945afc1.exe	31
PID 288 wrote to memory of 1064	288	4d9fb60e333f52c979bf29a3c945afc1.exe	31
PID 1656 wrote to memory of 1344	1656	cmd.exe	33
PID 1656 wrote to memory of 1344	1656	cmd.exe	33
PID 1656 wrote to memory of 1344	1656	cmd.exe	33
PID 1656 wrote to memory of 1344	1656	cmd.exe	33
PID 1064 wrote to memory of 2692	1064	cmd.exe	32
PID 1064 wrote to memory of 2692	1064	cmd.exe	32
PID 1064 wrote to memory of 2692	1064	cmd.exe	32
PID 1064 wrote to memory of 2692	1064	cmd.exe	32
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 1064 wrote to memory of 2180	1064	cmd.exe	35
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36
PID 2180 wrote to memory of 868	2180	winhost.exe	36

C:\Users\Admin\AppData\Local\Temp\4d9fb60e333f52c979bf29a3c945afc1.exe
"C:\Users\Admin\AppData\Local\Temp\4d9fb60e333f52c979bf29a3c945afc1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\4d9fb60e333f52c979bf29a3c945afc1.exe
  C:\Users\Admin\AppData\Local\Temp\4d9fb60e333f52c979bf29a3c945afc1.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "winhost" /tr '"C:\Users\Admin\AppData\Local\Temp\winhost.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "winhost" /tr '"C:\Users\Admin\AppData\Local\Temp\winhost.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6C69.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\winhost.exe
      "C:\Users\Admin\AppData\Local\Temp\winhost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\winhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\winhost.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab9F2E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C69.tmp.bat

Filesize
154B

MD5
5f47d4b8c533f5d9c20817e1b8f37ec5

SHA1
a683e87cb1e73b7c1aa77908987153e058714bfc

SHA256
31c30bda1bf1c2646324697d3efe2a0f6891116cae60dc0524165bfd4afd9ee1

SHA512
a0790542ceac9ac86a5a702cf9b0516d7426212b96e968f377b6fd9bd7f2e08d0b71eec6b63f7f02e96893c5e32b0239578cf1ff7c7e79f225a179ce9319c0f1

Download Submit
\Users\Admin\AppData\Local\Temp\winhost.exe

Filesize
745KB

MD5
4d9fb60e333f52c979bf29a3c945afc1

SHA1
9ada995cab8a1bc55d436ece3b045c53f160eba1

SHA256
b29156030acc1b80de8d66c918e137a33cd1ee264f9695ec96be208cf5faf10b

SHA512
6e3b05a1385f92ceb71db215a0e34097bab33d362301ca11ed85c0e96bbe9cd529e7204ac1691e6c111f037bbe0e5da638d282253a57e57ab671bd38fb23c845

Download Submit
memory/288-956-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/288-957-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/288-955-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/288-967-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/868-1925-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download
memory/868-1923-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/868-1924-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/868-1942-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/868-1943-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download
memory/2180-1906-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2180-973-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download
memory/2180-972-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2180-971-0x0000000000CE0000-0x0000000000DA0000-memory.dmp

Filesize
768KB

Download
memory/2180-1919-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2296-24-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-937-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2296-32-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-34-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-36-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-38-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-40-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-42-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-46-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-48-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-44-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-54-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-52-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-50-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-62-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-64-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-66-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-60-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-58-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-68-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-56-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-30-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-939-0x0000000004850000-0x000000000489C000-memory.dmp

Filesize
304KB

Download
memory/2296-938-0x0000000000700000-0x000000000074A000-memory.dmp

Filesize
296KB

Download
memory/2296-26-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-951-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-28-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-18-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-1-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-20-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-22-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-16-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-14-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-12-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-8-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-10-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-6-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-5-0x0000000000880000-0x000000000092D000-memory.dmp

Filesize
692KB

Download
memory/2296-4-0x0000000000880000-0x0000000000932000-memory.dmp

Filesize
712KB

Download
memory/2296-3-0x0000000000600000-0x00000000006B2000-memory.dmp

Filesize
712KB

Download
memory/2296-2-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2296-0-0x0000000000FC0000-0x0000000001080000-memory.dmp

Filesize
768KB

Download