Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
01/03/2024, 20:55
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
AsyncClient.exe
Resource
win10v2004-20240226-en
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
1318c166e2823474696400cb49c69019
-
SHA1
41cac1850c0e996752475baa19716b0dfcf88351
-
SHA256
5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
-
SHA512
1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f
-
SSDEEP
768:tuEs9THvkHCWU0neImo2q8HWdbFk+AH5PIM0690bRkYnT/fGdaRSl8BDZvx:tuEs9THc72ibF4H2M06abR1DOsRldvx
Malware Config
Extracted
asyncrat
0.5.8
adsf
FearME-55506.portmap.host:5508
FearME-55506.portmap.host:55506
LlyPtPKotdCY
-
delay
3
-
install
true
-
install_file
test.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000800000001ab2e-11.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 244 test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2904 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3548 timeout.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe 192 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 192 AsyncClient.exe Token: SeDebugPrivilege 244 test.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 192 wrote to memory of 4908 192 AsyncClient.exe 73 PID 192 wrote to memory of 4908 192 AsyncClient.exe 73 PID 192 wrote to memory of 4908 192 AsyncClient.exe 73 PID 192 wrote to memory of 4912 192 AsyncClient.exe 74 PID 192 wrote to memory of 4912 192 AsyncClient.exe 74 PID 192 wrote to memory of 4912 192 AsyncClient.exe 74 PID 4908 wrote to memory of 2904 4908 cmd.exe 77 PID 4908 wrote to memory of 2904 4908 cmd.exe 77 PID 4908 wrote to memory of 2904 4908 cmd.exe 77 PID 4912 wrote to memory of 3548 4912 cmd.exe 78 PID 4912 wrote to memory of 3548 4912 cmd.exe 78 PID 4912 wrote to memory of 3548 4912 cmd.exe 78 PID 4912 wrote to memory of 244 4912 cmd.exe 79 PID 4912 wrote to memory of 244 4912 cmd.exe 79 PID 4912 wrote to memory of 244 4912 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'3⤵
- Creates scheduled task(s)
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFED2.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3548
-
-
C:\Users\Admin\AppData\Roaming\test.exe"C:\Users\Admin\AppData\Roaming\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5c910cec0bd28b6fa70c0d6e4440b0512
SHA162b42e7925e925a003c15af6537fd67d786644c2
SHA25667b0dc44c8eaef07107eac1b919eb976ac644f894bd30cf6bd83e4009c584a70
SHA51283d68a61dbc906665280cde3f33d84135978bee5ccf4e48bbb10cb88de6348c3a3f6dbbc45c491024c792ccab4c4985bf464b80dc16e563a4813db442b9938c0
-
Filesize
47KB
MD51318c166e2823474696400cb49c69019
SHA141cac1850c0e996752475baa19716b0dfcf88351
SHA2565b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA5121fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f