Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/03/2024, 20:55
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
AsyncClient.exe
Resource
win10v2004-20240226-en
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
1318c166e2823474696400cb49c69019
-
SHA1
41cac1850c0e996752475baa19716b0dfcf88351
-
SHA256
5b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
-
SHA512
1fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f
-
SSDEEP
768:tuEs9THvkHCWU0neImo2q8HWdbFk+AH5PIM0690bRkYnT/fGdaRSl8BDZvx:tuEs9THc72ibF4H2M06abR1DOsRldvx
Malware Config
Extracted
asyncrat
0.5.8
adsf
FearME-55506.portmap.host:5508
FearME-55506.portmap.host:55506
LlyPtPKotdCY
-
delay
3
-
install
true
-
install_file
test.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral3/files/0x000800000002a716-11.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1584 test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3124 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1712 timeout.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe 4000 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4000 AsyncClient.exe Token: SeDebugPrivilege 1584 test.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4000 wrote to memory of 484 4000 AsyncClient.exe 82 PID 4000 wrote to memory of 484 4000 AsyncClient.exe 82 PID 4000 wrote to memory of 484 4000 AsyncClient.exe 82 PID 4000 wrote to memory of 3580 4000 AsyncClient.exe 83 PID 4000 wrote to memory of 3580 4000 AsyncClient.exe 83 PID 4000 wrote to memory of 3580 4000 AsyncClient.exe 83 PID 3580 wrote to memory of 1712 3580 cmd.exe 86 PID 3580 wrote to memory of 1712 3580 cmd.exe 86 PID 3580 wrote to memory of 1712 3580 cmd.exe 86 PID 484 wrote to memory of 3124 484 cmd.exe 87 PID 484 wrote to memory of 3124 484 cmd.exe 87 PID 484 wrote to memory of 3124 484 cmd.exe 87 PID 3580 wrote to memory of 1584 3580 cmd.exe 88 PID 3580 wrote to memory of 1584 3580 cmd.exe 88 PID 3580 wrote to memory of 1584 3580 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'3⤵
- Creates scheduled task(s)
PID:3124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6699.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1712
-
-
C:\Users\Admin\AppData\Roaming\test.exe"C:\Users\Admin\AppData\Roaming\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5373535f30badea65c0c6b4115711f4da
SHA1919e3f7e01c705d0cf812c49e0920a539517bffe
SHA25645b05de917e3250057cb33b00649b54d55b1b67cf83738517f4dd9445a74635a
SHA512feabb1b5cbe7e9408752f86693ef3a5e122d686df4f43f0b1b8a028c1744b5df1021529771530cbe68102832c5dc104a2ddc08e59fbd31b84f3081e320bbfb18
-
Filesize
47KB
MD51318c166e2823474696400cb49c69019
SHA141cac1850c0e996752475baa19716b0dfcf88351
SHA2565b23cda7e61a7e54331995b5eab48efd59ff50455881027ea8bd5cd70a6833a0
SHA5121fad54e3f6b8c1ac376456aa4f3be361898e9126955425f75181a7f9d2e28e09597a60a7ccd8588af47ebad9b3672ab53e09321b82bc51df4536442c96bc157f