asyncrat | cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Size 1.8MB
Sample240309-rd5n2aac21
SHA256 cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291
MD5 708cc3ae1a1320de92bd3c1d94f3394c
SHA1 44c086a83f5c3e0b16e25a5ab04663882252b406
SHA512 8a9f2b80c606732edec0d649167d0040409fe32ad78156f0da61edf402b46d5126419ab879e79d0fc43224d079ba0f4292b520d931e17a462e413c5863c9f313
SSDEEP 49152:zi39+084E6W4W8Vm/hD49aXZmMA8GadWb0/Rat9nD:G+HVb4W8QR49unDQ+gf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/948-22-0x0000000005B70000-0x0000000005B88000-memory.dmp	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2520	sg.tmp
948	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
948	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~2301421391520380814\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
948	svchost.exe
948	svchost.exe
948	svchost.exe
948	svchost.exe
948	svchost.exe
948	svchost.exe
948	svchost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeRestorePrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeCreateGlobalPrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: 33	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeIncBasePriorityPrivilege	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
Token: SeRestorePrivilege	2520	sg.tmp
Token: 35	2520	sg.tmp
Token: SeSecurityPrivilege	2520	sg.tmp
Token: SeSecurityPrivilege	2520	sg.tmp
Token: SeDebugPrivilege	948	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 640	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	90
PID 3380 wrote to memory of 640	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	90
PID 3380 wrote to memory of 2520	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	92
PID 3380 wrote to memory of 2520	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	92
PID 3380 wrote to memory of 2520	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	92
PID 3380 wrote to memory of 948	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	97
PID 3380 wrote to memory of 948	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	97
PID 3380 wrote to memory of 948	3380	cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe	97

C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe
"C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:640
- C:\Users\Admin\AppData\Local\Temp\~6626821038946459704~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\cdb7ab310764806ff2a8b60a5f7ef29a5bac275778635a55bd00ecc1dc038291.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~2301421391520380814"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\~2301421391520380814\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~2301421391520380814\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Office.txt

Path C:\Users\Admin\AppData\Local\Temp\~2301421391520380814\Office.txt
Size 111KB
SHA256 52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e
MD5 52a1fc2e368b7367f762959a594fd94e
SHA1 3718fcd1679443258d472b0ef8b18b2ac00ff916
SHA512 50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378
SSDEEP 3072:TWW1Kxu9KqzMxl1wmGa/uqWy3GDg5MRKXBwLs/:iWczEM+mGa/uqz95gKXAs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_elf.dll

Path C:\Users\Admin\AppData\Local\Temp\~2301421391520380814\msedge_elf.dll
Size 26KB
SHA256 2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2
MD5 457f1e9754479c07bfa7925fd743bdfa
SHA1 d2c99cca4749da75f5b3dd624943e425205f3828
SHA512 11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9
SSDEEP 768:GUnfIzUia6ZOXoRxGyFC75apCsBrvbwfqZ:jgzJZO0/FDpCurzwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\~2301421391520380814\svchost.exe
Size 833KB
SHA256 7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b
MD5 9a25c9f4ae1ae0206d0ac670fc26bfb0
SHA1 ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5
SHA512 ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1
SSDEEP 24576:oasTmsTDNwvFTDTJZhRK1T+Bda9td41kGZFF:PUYTDTy1be1rFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~6626821038946459704~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-21-0x00000000737E0000-0x0000000073F90000-memory.dmp

Download

memory/948-20-0x0000000003030000-0x000000000304C000-memory.dmp

Download

memory/948-22-0x0000000005B70000-0x0000000005B88000-memory.dmp

Download

memory/948-23-0x00000000063B0000-0x0000000006954000-memory.dmp

Download

memory/948-25-0x0000000077621000-0x0000000077622000-memory.dmp

Download

memory/948-26-0x0000000006180000-0x0000000006212000-memory.dmp

Download

memory/948-27-0x0000000006160000-0x000000000616A000-memory.dmp

Download

memory/948-28-0x00000000737E0000-0x0000000073F90000-memory.dmp

Download

memory/3380-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download