asyncrat | 9c32dfe9366cd900b272ce625381572ad85be6d6fd1c452e48c2b289103522f1

Analysis

max time kernel
150s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd9d3da2c7a63a88c44c8857fb285062.exe
Size 2.5MB
Sample240310-emrgjsbg69
SHA256 9c32dfe9366cd900b272ce625381572ad85be6d6fd1c452e48c2b289103522f1
MD5 bd9d3da2c7a63a88c44c8857fb285062
SHA1 4e6dc23cb739abb7f926daa22096832da8d4fcd3
SHA512 dcf16eb637a20a7192322bf0e28346ae73c2b47da60610233b57a48bc38927139b206ff67bed3a0fd1fbf0b66a0a0264c316df22df0cd5c278359ed31c9b4184
SSDEEP 49152:X5k3D1W2tOnUN7+b+/2RqOaRtm2jc7MYuKVpZebnlT1c+Hc+9u/Sm1M:X5i1JtOuSS/2L6t/4Zu4van7zzn5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.4H

Mutex

extiqtrzeqtxqjoa

Attributes

delay
0
install
true
install_file
scvhost.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/X37Jy9jA

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0008000000023237-21.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bd9d3da2c7a63a88c44c8857fb285062.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ab.exe

Executes dropped EXE 4 IoCs

pid	Process
4228	image.exe
2456	ab.exe
1824	bb.exe
4940	scvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
47	pastebin.com
48	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
452	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2836	timeout.exe
1100	timeout.exe
1260	timeout.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
2456	ab.exe
4940	scvhost.exe
4940	scvhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	ab.exe
Token: SeDebugPrivilege	4940	scvhost.exe
Token: SeDebugPrivilege	4940	scvhost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4228	2432	bd9d3da2c7a63a88c44c8857fb285062.exe	97
PID 2432 wrote to memory of 4228	2432	bd9d3da2c7a63a88c44c8857fb285062.exe	97
PID 2432 wrote to memory of 4228	2432	bd9d3da2c7a63a88c44c8857fb285062.exe	97
PID 4228 wrote to memory of 3484	4228	image.exe	99
PID 4228 wrote to memory of 3484	4228	image.exe	99
PID 4228 wrote to memory of 3484	4228	image.exe	99
PID 3484 wrote to memory of 2836	3484	cmd.exe	101
PID 3484 wrote to memory of 2836	3484	cmd.exe	101
PID 3484 wrote to memory of 2836	3484	cmd.exe	101
PID 3484 wrote to memory of 2456	3484	cmd.exe	102
PID 3484 wrote to memory of 2456	3484	cmd.exe	102
PID 3484 wrote to memory of 1100	3484	cmd.exe	103
PID 3484 wrote to memory of 1100	3484	cmd.exe	103
PID 3484 wrote to memory of 1100	3484	cmd.exe	103
PID 3484 wrote to memory of 1824	3484	cmd.exe	106
PID 3484 wrote to memory of 1824	3484	cmd.exe	106
PID 3484 wrote to memory of 1824	3484	cmd.exe	106
PID 2456 wrote to memory of 452	2456	ab.exe	114
PID 2456 wrote to memory of 452	2456	ab.exe	114
PID 2456 wrote to memory of 5012	2456	ab.exe	116
PID 2456 wrote to memory of 5012	2456	ab.exe	116
PID 5012 wrote to memory of 1260	5012	cmd.exe	118
PID 5012 wrote to memory of 1260	5012	cmd.exe	118
PID 5012 wrote to memory of 4940	5012	cmd.exe	122
PID 5012 wrote to memory of 4940	5012	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bd9d3da2c7a63a88c44c8857fb285062.exe
"C:\Users\Admin\AppData\Local\Temp\bd9d3da2c7a63a88c44c8857fb285062.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\patch\image.exe
  "C:\Users\Admin\AppData\Local\Temp\patch\image.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Untitled1.bat" > NUL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:2836
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ab.exe
      ab.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'scvhost"' /tr "'C:\Users\Admin\AppData\Roaming\scvhost.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9229.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:1260
      - C:\Users\Admin\AppData\Roaming\scvhost.exe
        
        "C:\Users\Admin\AppData\Roaming\scvhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:1100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\bb.exe
      bb.exe
      4⤵
      Executes dropped EXE
      PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

image.exe

Path C:\Users\Admin\AppData\Local\Temp\patch\image.exe
Size 171KB
SHA256 58505ca17b261822bfc5fcf1d73e532917eb7a3ea24917aa64970f76f0b8be3b
MD5 c57ca9cb0fde71f074a1da63c327ce3f
SHA1 e6af2383e6c375c1ecaf5e412271dfbb0a97b36b
SHA512 c6fdde77c51e037c94ad59f96ad9d2d201d677e5cf59a077966e731cee857d1737e9a2981a8acd367b086cbdf65d5c1202715c18aee7228fd0a5428725ea72f2
SSDEEP 3072:NvZxHZ6G3kLu7NQz8jz2D4/m162izYdqynuQ0mrnN5t5Gnrn4XNjh+Pc+Ga++Bnn:Nvx6GwQQz8M42wzYdqynzbGn7UjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp9229.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9229.tmp.bat
Size 151B
SHA256 ec0f46b07b2cb72efc21faa18a1bd281c984997e055482ac08c3229d02a39dfe
MD5 7df90a069a51ab76d095cede78b925e9
SHA1 ca17fdb91a3a4abe163487779b1f657bdf68da12
SHA512 a7f6b145ce54bc538640f0f522e778d16dab5f60cde0365fe274a412025170c1ee386da17f119bf54e4ab0ba2400c6518c6cd09e0da38ed1fe5391f65ff50546
MD5 SHA1 SHA512

Submit Download

ab.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ab.exe
Size 49KB
SHA256 490b3f8cd95d01bb22329099df19743e8da4c1bbd6602b14011fbfa77c45a86a
MD5 e33f69aede2d3c53e135eee25f7a1959
SHA1 e61ccfa1dc896b84a7470ca9034bf682233341de
SHA512 45738b4ca0f20befcd9e855fc1b4b6fda54586e5dede313be86beefd437c6539fae3c97e750278e7010f88717a10cc71325e70c08533c47a1e82f3983eb3ff0a
SSDEEP 1536:nnssb8SmMuQ2nNbYcUkenRubPsAMmVcl:njmM92NbY9ubPFM8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

bb.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\bb.exe
Size 56KB
SHA256 729a020ecb67c4ce6537a2db02c7f9abccdd1e403ca74091e6d0adfca1bdfe6c
MD5 8a1f7ce9d0db1e40a8a4a3e85c84a6e5
SHA1 f47f866b94b8ab6aaeb0456d89f1b05147e2df81
SHA512 7441afead48b408a5c2d9e2047ad311c4f8e0a1ade024d8d736b4ed65e66e0bf42b4f48382d72a8aeb6aa66e1f2cdde98b6b7259f2fc9a5291e985ce3859142f
SSDEEP 1536:qB5IWuOTrBnqF4G8P9TuM9OhdRjR4byLyAtX+:qB5IWuOSE9yMohdRjyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Untitled1.bat

Path C:\Users\Admin\AppData\Roaming\Untitled1.bat
Size 597B
SHA256 a5a6bfa592b70d7a6c647bdd2831523b008a70e566c46fc94808bb98eac04587
MD5 5615c92cae46452dbf9db694d5a96cc2
SHA1 8e7a4c8738b25b49747f5410eb45c60823c70d2a
SHA512 a8c72051169110dab373ba2ec6b9ef7eafbcf5926123c3ff9f3c8a0e53b4450d0d91b5545d5c53707fd3f6ab3de78c4bc0962a642b8c1910d7a1069bd67f8f38
MD5 SHA1 SHA512

Submit Download

scvhost.exe

Path C:\Users\Admin\AppData\Roaming\scvhost.exe
Size 4.8MB
SHA256 9c2e23cf8a4cb2b7241b9f2783358b5f750bbf02731b0e85b76baa4fec77b349
MD5 1d4e715fef000336268489199461b812
SHA1 40c3f502e389fff534fdda778f01e0a8b81ef969
SHA512 58ed2bbcd8158512742d8ceea4dc65540df38738d70fd6086b73cc5aa16a38c2fd27102a3e6e1805e9e7386b4934c8b89a1f20cdcd569fa330ace4f0616fa4ca
SSDEEP 98304:C71StSbkWhrMOwwWp29S4j5wil7JuoUcuwYTHomijP7IpZ9aBvIaQX:C71SOW0PpUcuwkZ92AX
MD5 SHA1 SHA512 SSDEEP

Submit Download

scvhost.exe

Path C:\Users\Admin\AppData\Roaming\scvhost.exe
Size 5.6MB
SHA256 591a5832fc8399d7ac0baff0cc7d754368bfb1af6659407a2d1665e891f0cbb5
MD5 94d37129025ce77ab961dfd8fa31217f
SHA1 8fcfe024a19e9d6773a676da72260f5ec5540fc3
SHA512 c8a2e2e66ab5d5783d359342bc6cd451c4df1cd2a29aa1e6116a236ef7931aea5cb02c3b20a1e09f04e4ad06d709fbd8d3e23496b1cab2890c671e18f1d84b33
SSDEEP 98304:C71StSbkWhrMOwwWp29S4j5wil7JuoUcuwYTHomijP7IpZ9aBvIaQqfobr5/WAF:C71SOW0PpUcuwkZ92AGeWK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1824-47-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1824-29-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1824-52-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1824-42-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1824-50-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2456-23-0x00007FF983330000-0x00007FF983DF1000-memory.dmp

Download

memory/2456-35-0x00007FF983330000-0x00007FF983DF1000-memory.dmp

Download

memory/2456-22-0x0000000000B50000-0x0000000000B62000-memory.dmp

Download

memory/2456-28-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4940-40-0x00007FF982930000-0x00007FF9833F1000-memory.dmp

Download

memory/4940-45-0x0000000001340000-0x0000000001350000-memory.dmp

Download

memory/4940-44-0x00007FF982930000-0x00007FF9833F1000-memory.dmp

Download

memory/4940-41-0x0000000001340000-0x0000000001350000-memory.dmp

Download