asyncrat | b9371b217090aadf41da567face2032494d9fc5d7e4bb438dad702814c88fb97

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Confirmation.exe
Size 846KB
Sample240125-28jp6aacdr
SHA256 b9371b217090aadf41da567face2032494d9fc5d7e4bb438dad702814c88fb97
MD5 68c6e04dbbdef9cd85f8ea7a88928e12
SHA1 48a629000a7f7537c6207c6ab5d874b2ed735028
SHA512 b2e50e55a151fdc2cd2b7a5cd6665ca0a8096df568487df0657f6e262eed458af59db195ccc191f4c496b032ccf4032484470483ad5d0202e3d0ce2de5523b3f
SSDEEP 24576:ZD3s67JlbkRA3azIqa2hGa4jr2KKgp6BefqZfQ:lX7VazIqhh/gLKGSeSZfQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat reservation rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

reservation

178.33.57.153:4449

Mutex

rpawltnzguizj

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1336 created 3524	1336	Pump.pif	55

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3096-37-0x0000000000F50000-0x0000000000F68000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Confirmation.exe

Executes dropped EXE 2 IoCs

pid	Process
1336	Pump.pif
3096	jsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4512	tasklist.exe
1392	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2224	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe
3096	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	1392	tasklist.exe
Token: SeDebugPrivilege	3096	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1336	Pump.pif
1336	Pump.pif
1336	Pump.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	jsc.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1700	1872	Confirmation.exe	89
PID 1872 wrote to memory of 1700	1872	Confirmation.exe	89
PID 1872 wrote to memory of 1700	1872	Confirmation.exe	89
PID 1700 wrote to memory of 3092	1700	cmd.exe	91
PID 1700 wrote to memory of 3092	1700	cmd.exe	91
PID 1700 wrote to memory of 3092	1700	cmd.exe	91
PID 3092 wrote to memory of 4512	3092	cmd.exe	92
PID 3092 wrote to memory of 4512	3092	cmd.exe	92
PID 3092 wrote to memory of 4512	3092	cmd.exe	92
PID 3092 wrote to memory of 1076	3092	cmd.exe	93
PID 3092 wrote to memory of 1076	3092	cmd.exe	93
PID 3092 wrote to memory of 1076	3092	cmd.exe	93
PID 3092 wrote to memory of 1392	3092	cmd.exe	95
PID 3092 wrote to memory of 1392	3092	cmd.exe	95
PID 3092 wrote to memory of 1392	3092	cmd.exe	95
PID 3092 wrote to memory of 2976	3092	cmd.exe	96
PID 3092 wrote to memory of 2976	3092	cmd.exe	96
PID 3092 wrote to memory of 2976	3092	cmd.exe	96
PID 3092 wrote to memory of 3764	3092	cmd.exe	99
PID 3092 wrote to memory of 3764	3092	cmd.exe	99
PID 3092 wrote to memory of 3764	3092	cmd.exe	99
PID 3092 wrote to memory of 4120	3092	cmd.exe	100
PID 3092 wrote to memory of 4120	3092	cmd.exe	100
PID 3092 wrote to memory of 4120	3092	cmd.exe	100
PID 3092 wrote to memory of 1340	3092	cmd.exe	101
PID 3092 wrote to memory of 1340	3092	cmd.exe	101
PID 3092 wrote to memory of 1340	3092	cmd.exe	101
PID 3092 wrote to memory of 1336	3092	cmd.exe	102
PID 3092 wrote to memory of 1336	3092	cmd.exe	102
PID 3092 wrote to memory of 1336	3092	cmd.exe	102
PID 3092 wrote to memory of 2224	3092	cmd.exe	103
PID 3092 wrote to memory of 2224	3092	cmd.exe	103
PID 3092 wrote to memory of 2224	3092	cmd.exe	103
PID 1336 wrote to memory of 3096	1336	Pump.pif	109
PID 1336 wrote to memory of 3096	1336	Pump.pif	109
PID 1336 wrote to memory of 3096	1336	Pump.pif	109
PID 1336 wrote to memory of 3096	1336	Pump.pif	109
PID 1336 wrote to memory of 3096	1336	Pump.pif	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\Confirmation.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirmation.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k cmd < Contributed & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:1076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe"
        5⤵
        
        PID:2976
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 6220
        5⤵
        
        PID:3764
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Wondering + Nottingham + Consequences + Overall + Refugees + Plasma 6220\Pump.pif
        5⤵
        
        PID:4120
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Safer + Retain 6220\K
        5⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\Pump.pif
        
        6220\Pump.pif 6220\K
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1336
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:2224
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\jsc.exe
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\jsc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\K
Size 503KB
SHA256 09f76edb7febff67c14e7c4ab30fcc7da168274115c10bbed62baa659588c29a
MD5 b703638afc700c1283fd2848d05fbf4b
SHA1 05988cfa95ac25d7efaad277eb46944d8dae8a79
SHA512 a7ddc06e4afb68114a0d67dda3c0caa8b0df22c5c65f529c13a3bc4e5b15084737e026a7719ff568443428079813a25d183459ff742e2a8c6fd6d6504ce8543f
SSDEEP 6144:BWM0LXipOD1XMST7dQTi1efHK1VBBXPSJEZpMvE1:BD0TipOD1XMST7GTi1efq1VDXPGLvE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pump.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\Pump.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsc.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\6220\jsc.exe
Size 46KB
SHA256 39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5
MD5 94c8e57a80dfca2482dedb87b93d4fd9
SHA1 5729e6c7d2f5ab760f0093b9d44f8ac0f876a803
SHA512 1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc
SSDEEP 768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Consequences

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Consequences
Size 108KB
SHA256 183440274f9fb35d081b552e9064b6df8bf72b0a152a2aeb97db1d01b2107da7
MD5 ea8a89bf041ef6a76306b9bb9ec54c13
SHA1 6e394d98b1db046a43771a64d27853699ad35a96
SHA512 d31b122a8b4a76318e379c740eb75a42f7c5677e4403a8defac89017966c7ae0e168e05766ebc509c2bf3f4cb3cabc08aaba4c514800387f3a3fc372a6cc4081
SSDEEP 3072:/H7fsUQwHJJX4xF5jtHk5B+LNBPcAvPTjFq9:TsvqJX4xNAB+xHFq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Contributed

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Contributed
Size 13KB
SHA256 73186850de792bea94aac92b16adbcadb5cc3c9c45646ae37249e44ab83d138d
MD5 f46cc98d998a8a287ae92a3b8eb4b4cf
SHA1 c4a22c670e9bb392bd0c45cae5bdfd40cc7a53b6
SHA512 a39448a81eba88547ce58d99359220250ac21276f126e25c3133557874739db26e0e1ee45c54d49a931d5a904466a9e381076a9b005e306ae7a416e42016011f
SSDEEP 384:pJhzE3LhRi2y+jN2uWf5wi0g3i0l90+r0WPtCOQu0vu24fD0WPtCOfD9fc9H83El:pPEy+jEX030r0+r0wtvQu0va0wtv7J0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nottingham

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Nottingham
Size 220KB
SHA256 847465577b754bef7a6f2ba373910af17f030c2f06c5fdd4a74eec2b9ec2697c
MD5 52dc2596e8c6555d8d125db1ee03a743
SHA1 4adb7213105a8156a43ee35a8e6a35f1070a4f0b
SHA512 aa7d42b3dec3c7af083efcfc461a086a2ccdda4978abcce7473fbe6a4f4b7fa3f33c288beb3753935a0173b923fb984937188f4ff05e4c504fae08fb296d2c36
SSDEEP 6144:cd12lqlEAehuqN8zwNzlmhPL1b5nZ2tZ6lfA6Gfm6083:cClqlEZuB1b5Z2tZ6XKmA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Overall

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Overall
Size 130KB
SHA256 1ce8d050bfdcc78bfcf00e828c0bda8aaae9e4d37b1b468dc3d71d9645422a9f
MD5 a97ba072478480d835399d8a0e32a2db
SHA1 9090d9ff0352c56474d9411e63a34b9026b789ca
SHA512 d6b7e46d79ee0e399e586c246bfa1a9954bc3a78deb59b10a9fe9122fa0a016c07c083b33b3ae061a165dafb4b27227db6a7fb124d6aa5bbe1ee68841301b2d6
SSDEEP 3072:ziOIXyTw0ltj0EowPOGU6WS2uLhxjRYH/fA9vtqmcCVs5A3q5eAg0Fuz0A:zO0lHPOGUWLhxjRYmFqZvEAOz0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plasma

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Plasma
Size 608B
SHA256 adb57134d46eb2d7ea255a7973fa132ab1aa8cf8fe484abc02083289b468c29f
MD5 0052d4fe77a4039b5611bd09d7659e12
SHA1 783e5f55e0a2d88a878c51b30a0f8d738187e951
SHA512 9ab40d513bee4ac8924b53512faa99cfe3e4b269776ceff96dc9af857ef40e748f85c9cc277d4200dd2fc42ae0ecb0d813bb2b36ed12fe3c0f2c495a244b4332
MD5 SHA1 SHA512

Submit Download

Refugees

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Refugees
Size 246KB
SHA256 257fb54dbdc3dd4f2d6c5ad83cc2b490659a1e9131fa7770e6b7fc177c6cf9cb
MD5 186cfb7c649fc31c0c4de946b73b59b1
SHA1 8f4a650952e13528b54e566d219f38a1e616e2aa
SHA512 6e1d6baeaf418fcc6ee095cb80017578205f5b2b689c3712da0e2d8f9138aac2da72de334b95542938a8e803893090e2cbd8a30d8e00d48c638d135e4cf4a656
SSDEEP 3072:5XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2OE:dpmdV364EgarxUaBZ2myow
MD5 SHA1 SHA512 SSDEEP

Submit Download

Retain

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Retain
Size 18KB
SHA256 00daf976b497232515a9e1d472fb46721e378b30160c3a2794fe41df7311506a
MD5 833ca83b4d24cec35ef492dec65886e7
SHA1 71c9241e60f431cfab96544f142d84b792be617d
SHA512 580cac5b4c6b3a45b739b391ace3bb4f58f37b51447983e0eee90e22e51377fd631b229f6761c7c446422e90d45823cec5d1eb4f14ff464b612425e9b509427e
SSDEEP 384:8cYwGUhOH4VjWYT7NYmRmuasIpwT7Ts8+8TtsF:8ZJ3YFFDRh/ca7Ts8F0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Safer

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Safer
Size 485KB
SHA256 be5eafc8bc2c75f25e87d91808a7bcbd0458c2d4b725e3f9d77361214332f48f
MD5 9d7dcace5bb79a24c7328e7919d21e87
SHA1 e3b553c1c5ca62519e9aabc038e4587cbddb02bb
SHA512 62d8fa6a45d4331fc60c09262a52fa764e49b169011d6cb0b8acf554f31e371c3e3d47bc15560a4f585bec396724abeccde8060bf3ba4489e15df65833e82396
SSDEEP 6144:BWM0LXipOD1XMST7dQTi1efHK1VBBXPSJ/:BD0TipOD1XMST7GTi1efq1VDXPG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wondering

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Wondering
Size 220KB
SHA256 f75bba1df8451300514ac0a6c55412c6fa90caad0decd032428d7891c96e58d5
MD5 7edb4d01a203fcb1e6881f025da43b99
SHA1 afe024048b0cdbaaeb4b61d5b2bf3eb2dfc226f5
SHA512 367d57d807b001f6896fd05f5e6f847e520338294cd0d4dfa681a394e48bfde2ef7aea3173f8a9aeea51df1b8818ca2bafafc39db9d5382d62b44b459a85ec6b
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mp:LO0z8e0lvSr0Wyw20K4mp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-35-0x00000000018B0000-0x00000000018B1000-memory.dmp

Download

memory/1872-0-0x00000000770A1000-0x00000000771C1000-memory.dmp

Download

memory/3096-40-0x0000000072650000-0x0000000072E00000-memory.dmp

Download

memory/3096-37-0x0000000000F50000-0x0000000000F68000-memory.dmp

Download

memory/3096-41-0x0000000005B10000-0x00000000060B4000-memory.dmp

Download

memory/3096-43-0x00000000054F0000-0x0000000005500000-memory.dmp

Download

memory/3096-44-0x0000000077101000-0x0000000077102000-memory.dmp

Download

memory/3096-45-0x0000000006260000-0x00000000062F2000-memory.dmp

Download

memory/3096-46-0x00000000061F0000-0x00000000061FA000-memory.dmp

Download

memory/3096-47-0x0000000072650000-0x0000000072E00000-memory.dmp

Download

memory/3096-48-0x00000000054F0000-0x0000000005500000-memory.dmp

Download