asyncrat | c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Size 1.8MB
Sample240309-h54rdaef9t
SHA256 c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3
MD5 63b9d980ce167685f61415d082dc681b
SHA1 603140235d53cef46e3bac28cdddd5206a1c4246
SHA512 a4161de9bdd90a7260d086080970c3f06df8a99b8cb2db8339b6d105d5b37b47f6e362b7972a6a562263e7d70dc055d5050d5f4ca12215329146fc3b7ad4e25c
SSDEEP 49152:zi39+084E6W4W8+m/oX49aXZmMA88DOKmX:G+HVb4W8b+49unDfTX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2320-22-0x00000000054A0000-0x00000000054B8000-memory.dmp	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4836	sg.tmp
2320	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~3609580389694621222\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeRestorePrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeCreateGlobalPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeRestorePrivilege	4836	sg.tmp
Token: 35	4836	sg.tmp
Token: SeSecurityPrivilege	4836	sg.tmp
Token: SeSecurityPrivilege	4836	sg.tmp
Token: SeDebugPrivilege	2320	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1648	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	98
PID 2204 wrote to memory of 1648	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	98
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104

C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
"C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\~1847069799749926311~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~3609580389694621222"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~1847069799749926311~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Office.txt

Path C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\Office.txt
Size 111KB
SHA256 52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e
MD5 52a1fc2e368b7367f762959a594fd94e
SHA1 3718fcd1679443258d472b0ef8b18b2ac00ff916
SHA512 50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378
SSDEEP 3072:TWW1Kxu9KqzMxl1wmGa/uqWy3GDg5MRKXBwLs/:iWczEM+mGa/uqz95gKXAs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_elf.dll

Path C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\msedge_elf.dll
Size 26KB
SHA256 2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2
MD5 457f1e9754479c07bfa7925fd743bdfa
SHA1 d2c99cca4749da75f5b3dd624943e425205f3828
SHA512 11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9
SSDEEP 768:GUnfIzUia6ZOXoRxGyFC75apCsBrvbwfqZ:jgzJZO0/FDpCurzwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe
Size 833KB
SHA256 7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b
MD5 9a25c9f4ae1ae0206d0ac670fc26bfb0
SHA1 ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5
SHA512 ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1
SSDEEP 24576:oasTmsTDNwvFTDTJZhRK1T+Bda9td41kGZFF:PUYTDTy1be1rFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2204-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2320-21-0x0000000074E60000-0x0000000075610000-memory.dmp

Download

memory/2320-20-0x0000000002960000-0x000000000297C000-memory.dmp

Download

memory/2320-22-0x00000000054A0000-0x00000000054B8000-memory.dmp

Download

memory/2320-23-0x0000000005DB0000-0x0000000006354000-memory.dmp

Download

memory/2320-25-0x0000000077941000-0x0000000077942000-memory.dmp

Download

memory/2320-26-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Download

memory/2320-27-0x0000000005C90000-0x0000000005C9A000-memory.dmp

Download

memory/2320-28-0x0000000074E60000-0x0000000075610000-memory.dmp

Download