Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 00:02

General

  • Target

    6e2fb9abe3419002ed655109d4ec85f5.exe

  • Size

    234KB

  • MD5

    6e2fb9abe3419002ed655109d4ec85f5

  • SHA1

    781f1be80c1b4e563b2314aa24b8971e42b42a80

  • SHA256

    fa725ece6f7cf6149d8b5a637f9f254efb105e184276666ba07ef9812564626b

  • SHA512

    235edd74aef197bc62e7a244e71b2fa633d79e8add0a48340e9d8e8f5fc491a090968716d6d921e2beecb6115df097a65fed8ce1f33ce3167a4a46ce0534decf

  • SSDEEP

    3072:oF8uspQjfwe2IhASAt7q80brmX71hEbaFSkjiRrP:oWpoVhA9t7vorva+

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.76.155.94:6606

45.76.155.94:7707

45.76.155.94:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e2fb9abe3419002ed655109d4ec85f5.exe
    "C:\Users\Admin\AppData\Local\Temp\6e2fb9abe3419002ed655109d4ec85f5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor' -Value '"C:\Users\Admin\AppData\Roaming\HWMonitor\HWMonitor.exe"' -PropertyType 'String'
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2972

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13i5tat1.eoh.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/1832-22-0x0000000005A90000-0x0000000005AF6000-memory.dmp

            Filesize

            408KB

          • memory/1832-21-0x0000000005970000-0x0000000005992000-memory.dmp

            Filesize

            136KB

          • memory/1832-37-0x0000000006D10000-0x0000000006D2A000-memory.dmp

            Filesize

            104KB

          • memory/1832-38-0x0000000006D60000-0x0000000006D82000-memory.dmp

            Filesize

            136KB

          • memory/1832-35-0x00000000068E0000-0x000000000692C000-memory.dmp

            Filesize

            304KB

          • memory/1832-34-0x0000000006830000-0x000000000684E000-memory.dmp

            Filesize

            120KB

          • memory/1832-36-0x0000000007840000-0x00000000078D6000-memory.dmp

            Filesize

            600KB

          • memory/1832-41-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/1832-33-0x00000000062B0000-0x0000000006604000-memory.dmp

            Filesize

            3.3MB

          • memory/1832-28-0x0000000006240000-0x00000000062A6000-memory.dmp

            Filesize

            408KB

          • memory/1832-14-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/1832-16-0x0000000002F30000-0x0000000002F40000-memory.dmp

            Filesize

            64KB

          • memory/1832-15-0x0000000002F40000-0x0000000002F76000-memory.dmp

            Filesize

            216KB

          • memory/1832-20-0x0000000005BA0000-0x00000000061C8000-memory.dmp

            Filesize

            6.2MB

          • memory/1832-19-0x0000000002F30000-0x0000000002F40000-memory.dmp

            Filesize

            64KB

          • memory/2972-17-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/2972-42-0x0000000005510000-0x0000000005520000-memory.dmp

            Filesize

            64KB

          • memory/2972-44-0x0000000005510000-0x0000000005520000-memory.dmp

            Filesize

            64KB

          • memory/2972-12-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2972-43-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/3048-5-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

            Filesize

            40KB

          • memory/3048-8-0x0000000004D30000-0x0000000004D40000-memory.dmp

            Filesize

            64KB

          • memory/3048-7-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/3048-6-0x0000000004D40000-0x0000000004DB6000-memory.dmp

            Filesize

            472KB

          • memory/3048-0-0x00000000000B0000-0x00000000000F2000-memory.dmp

            Filesize

            264KB

          • memory/3048-4-0x0000000004D30000-0x0000000004D40000-memory.dmp

            Filesize

            64KB

          • memory/3048-3-0x0000000004AE0000-0x0000000004B72000-memory.dmp

            Filesize

            584KB

          • memory/3048-2-0x0000000005090000-0x0000000005634000-memory.dmp

            Filesize

            5.6MB

          • memory/3048-1-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/3048-9-0x0000000004C90000-0x0000000004CA6000-memory.dmp

            Filesize

            88KB

          • memory/3048-10-0x0000000004E00000-0x0000000004E1E000-memory.dmp

            Filesize

            120KB

          • memory/3048-18-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB