Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2024, 20:55
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
AsyncClient.exe
Resource
win10v2004-20240226-en
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
1318c166e2823474696400cb49c69019
-
SHA1
41cac1850c0e996752475baa19716b0dfcf88351
-
SHA256
5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
-
SHA512
1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f
-
SSDEEP
768:tuEs9THvkHCWU0neImo2q8HWdbFk+AH5PIM0690bRkYnT/fGdaRSl8BDZvx:tuEs9THc72ibF4H2M06abR1DOsRldvx
Malware Config
Extracted
asyncrat
0.5.8
adsf
FearME-55506.portmap.host:5508
FearME-55506.portmap.host:55506
LlyPtPKotdCY
-
delay
3
-
install
true
-
install_file
test.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023282-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
pid Process 764 test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 628 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4988 timeout.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe 1904 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1904 AsyncClient.exe Token: SeDebugPrivilege 764 test.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1904 wrote to memory of 4056 1904 AsyncClient.exe 98 PID 1904 wrote to memory of 4056 1904 AsyncClient.exe 98 PID 1904 wrote to memory of 4056 1904 AsyncClient.exe 98 PID 1904 wrote to memory of 452 1904 AsyncClient.exe 100 PID 1904 wrote to memory of 452 1904 AsyncClient.exe 100 PID 1904 wrote to memory of 452 1904 AsyncClient.exe 100 PID 4056 wrote to memory of 628 4056 cmd.exe 102 PID 4056 wrote to memory of 628 4056 cmd.exe 102 PID 4056 wrote to memory of 628 4056 cmd.exe 102 PID 452 wrote to memory of 4988 452 cmd.exe 103 PID 452 wrote to memory of 4988 452 cmd.exe 103 PID 452 wrote to memory of 4988 452 cmd.exe 103 PID 452 wrote to memory of 764 452 cmd.exe 104 PID 452 wrote to memory of 764 452 cmd.exe 104 PID 452 wrote to memory of 764 452 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'3⤵
- Creates scheduled task(s)
PID:628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp335F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4988
-
-
C:\Users\Admin\AppData\Roaming\test.exe"C:\Users\Admin\AppData\Roaming\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:1548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD55fa55660c88c837db90adf9958fe28ce
SHA1f7e248a53f0f650a6f8e27427fba11e1c7010fa0
SHA25663a1a9a23023aa29057fc517ef1532b58f1824183765ee744800773a16c6fd70
SHA5127ba5d44d67cb74fb47cd3fc18d0a05530d73464f9fd3793569dd1d892f0ad9e65a8fedd48d8c2bb3974cd7311e2c720e92889a7bef9538a88d2f83c376be40fd
-
Filesize
47KB
MD51318c166e2823474696400cb49c69019
SHA141cac1850c0e996752475baa19716b0dfcf88351
SHA2565b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA5121fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f