Malware Analysis Report

2025-06-16 02:14

Sample ID 240123-ksq1vsghcq
Target 01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639
SHA256 01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639

Threat Level: Known bad

The file 01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639 was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Async RAT payload

AsyncRat

Asyncrat family

Async RAT payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Unsigned PE

Enumerates physical storage devices

Enumerates system info in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-23 08:52

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-23 08:52

Reported

2024-01-23 08:54

Platform

win7-20231129-en

Max time kernel

149s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2652 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3008 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1656 wrote to memory of 2280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1656 wrote to memory of 2280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1656 wrote to memory of 2280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1656 wrote to memory of 2280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2736 wrote to memory of 2692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 2788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 1900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 1900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2736 wrote to memory of 1900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe

"C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Axenta" /tr '"C:\Users\Admin\AppData\Roaming\Axenta.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1719.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Axenta" /tr '"C:\Users\Admin\AppData\Roaming\Axenta.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7279758,0x7fef7279768,0x7fef7279778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:1

C:\Users\Admin\AppData\Roaming\Axenta.exe

"C:\Users\Admin\AppData\Roaming\Axenta.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1328 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3660 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1360,i,13528964455295118243,16545947149687357340,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.238:443 apis.google.com tcp
N/A 224.0.0.251:5353 udp
US 20.98.203.218:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 20.98.203.218:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 20.98.203.218:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp

Files

memory/2652-0-0x0000000000DC0000-0x0000000000DD2000-memory.dmp

memory/2652-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

memory/2652-2-0x00000000022B0000-0x00000000022F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1719.tmp.bat

MD5 6ce721d2f3478fa5796f3c4301fd4337
SHA1 61698e18008a05d8826e05285490e8350263fc12
SHA256 de824d0bcc4bffb69c33b69827908f8f948d04dbd85e5e84df340326b392b9e9
SHA512 ec4f61d45cd38bb16877cd417cda778c101bd523dfc28d725fd7a69e411c4d0eeca796c6092b267e1dc28a024a216484fb007e809017882b2a40dad8be1722d1

memory/2652-12-0x0000000074BE0000-0x00000000752CE000-memory.dmp

\??\pipe\crashpad_2736_RFVRZGVPTPYDLWGF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

\Users\Admin\AppData\Roaming\Axenta.exe

MD5 1f58a5ef877adab164e528929729d3b0
SHA1 d1aa7ed83011d8b5c72c875f0e30ccc31d6c245d
SHA256 01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639
SHA512 f7698c86454d034460946effb224c2922806b5c39686ef9817befecb033f72a9d03f400baaa69516396756e80ebfc63f7ed8f1b60eaf5f4702c4ccfc964ae03d

memory/596-56-0x0000000001300000-0x0000000001312000-memory.dmp

memory/596-57-0x0000000074B90000-0x000000007527E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5dbd2b02-a02f-43f8-af6e-0f44420b5db4.tmp

MD5 bc70a3ec0494dd8a62d7ada7d19b09a4
SHA1 f5872ad65000eaa674eeee4eb09fafeb3f702980
SHA256 8ccc830567a3098f9b1447867cff126c63da14910031659805a3b0abf4b88be8
SHA512 ecd5f4a08ff69a8a6d2b06e02bfaef42079684df68c714fef523398cb8df69c4f60977184a968c4f28dd66cf87a9a9d6cfc48203d2c35f812867d922f3ca61da

memory/596-187-0x0000000000B70000-0x0000000000BB0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

memory/596-199-0x0000000074B90000-0x000000007527E000-memory.dmp

memory/596-200-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-23 08:52

Reported

2024-01-23 08:54

Platform

win10v2004-20231215-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Axenta.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1152 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 1152 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 1152 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 1152 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 1152 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 1152 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2436 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2436 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1636 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Axenta.exe
PID 2436 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Axenta.exe
PID 2436 wrote to memory of 4872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Axenta.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe

"C:\Users\Admin\AppData\Local\Temp\01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Axenta" /tr '"C:\Users\Admin\AppData\Roaming\Axenta.exe"' & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Axenta" /tr '"C:\Users\Admin\AppData\Roaming\Axenta.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp611B.tmp.bat""

C:\Users\Admin\AppData\Roaming\Axenta.exe

"C:\Users\Admin\AppData\Roaming\Axenta.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 20.98.203.218:8080 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 20.98.203.218:8080 tcp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 20.98.203.218:8080 tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 20.98.203.218:8080 tcp
US 20.98.203.218:8080 tcp

Files

memory/1152-0-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

memory/1152-1-0x0000000074480000-0x0000000074C30000-memory.dmp

memory/1152-2-0x0000000005610000-0x0000000005620000-memory.dmp

memory/1152-3-0x00000000056C0000-0x000000000575C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp611B.tmp.bat

MD5 e5683e9b399ba8c585895838e1f4d6f3
SHA1 547bd9a7f595b7a7d7b48d5b144eb2c0db3429dc
SHA256 2e89febc7b91ed7f3f740b7d5957dddcc6d48ff03ef2be3e401d2c5b68a548c0
SHA512 9fa4d00e62f47cd87f7be0da1c57e84a6085a66d4702ee07e6342f5ad622919220a013a520da24b4b927dfade57f4197c0e36330fc98383dab51179ece47c744

memory/1152-9-0x0000000074480000-0x0000000074C30000-memory.dmp

C:\Users\Admin\AppData\Roaming\Axenta.exe

MD5 1f58a5ef877adab164e528929729d3b0
SHA1 d1aa7ed83011d8b5c72c875f0e30ccc31d6c245d
SHA256 01ba5474eb258af7537da60d65d652a9f6acd92c7f0799db01356261f019c639
SHA512 f7698c86454d034460946effb224c2922806b5c39686ef9817befecb033f72a9d03f400baaa69516396756e80ebfc63f7ed8f1b60eaf5f4702c4ccfc964ae03d

memory/4872-13-0x00000000743E0000-0x0000000074B90000-memory.dmp

memory/4872-14-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/4872-15-0x00000000743E0000-0x0000000074B90000-memory.dmp

memory/4872-16-0x00000000052E0000-0x00000000052F0000-memory.dmp