asyncrat | 72ec6f81b0de47f93bb8941bd86a10377a0bd6e5f188120679396ede0886a4b3

Analysis

max time kernel
586s
max time network
601s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/03/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/WindowsUpdates.exe
Size 487KB
Sample240323-snmrmsbe6s
SHA256 8d2f5e538fecbbc4e1b210e46a3ff23e83d3e5d41889620a152d64e5837664f9
MD5 6ff93fe40aac2479a62a5e6a32f96aeb
SHA1 d5bdaca9eac46965b306aba3362fa81c60082d20
SHA512 151c5ddedd0df4866ebac29a75bcd88e50acf50e0087c63455ce6a1a0a706870b74a6e2c86cebf3c4221d800e2715b8fb872d71d884eabddef8e8b8b12e48d79
SSDEEP 12288:zy4elxMgArBBFxw90ZGAfYXQI7nlgMhZY5apWsjZtRupwNz:zy4eMXBsyvfYXQI7tJ7Rv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default evasion persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

inteldns.ddns.me:4449

Mutex

lofeuunpwty

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2868	svchost.exe

Loads dropped DLL 6 IoCs

pid	Process
2648	cmd.exe
1360	WerFault.exe
1360	WerFault.exe
1360	WerFault.exe
1360	WerFault.exe
1360	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	WindowsUpdates.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2836	2868	svchost.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2752	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1948	timeout.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2912	WindowsUpdates.exe
2912	WindowsUpdates.exe
2912	WindowsUpdates.exe
2480	powershell.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe
2836	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	WindowsUpdates.exe
Token: SeDebugPrivilege	2868	svchost.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2836	regsvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	regsvcs.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2620	2912	WindowsUpdates.exe	28
PID 2912 wrote to memory of 2620	2912	WindowsUpdates.exe	28
PID 2912 wrote to memory of 2620	2912	WindowsUpdates.exe	28
PID 2912 wrote to memory of 2648	2912	WindowsUpdates.exe	30
PID 2912 wrote to memory of 2648	2912	WindowsUpdates.exe	30
PID 2912 wrote to memory of 2648	2912	WindowsUpdates.exe	30
PID 2620 wrote to memory of 2752	2620	cmd.exe	32
PID 2620 wrote to memory of 2752	2620	cmd.exe	32
PID 2620 wrote to memory of 2752	2620	cmd.exe	32
PID 2648 wrote to memory of 1948	2648	cmd.exe	33
PID 2648 wrote to memory of 1948	2648	cmd.exe	33
PID 2648 wrote to memory of 1948	2648	cmd.exe	33
PID 2648 wrote to memory of 2868	2648	cmd.exe	34
PID 2648 wrote to memory of 2868	2648	cmd.exe	34
PID 2648 wrote to memory of 2868	2648	cmd.exe	34
PID 2868 wrote to memory of 2480	2868	svchost.exe	35
PID 2868 wrote to memory of 2480	2868	svchost.exe	35
PID 2868 wrote to memory of 2480	2868	svchost.exe	35
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 2836	2868	svchost.exe	37
PID 2868 wrote to memory of 1360	2868	svchost.exe	38
PID 2868 wrote to memory of 1360	2868	svchost.exe	38
PID 2868 wrote to memory of 1360	2868	svchost.exe	38

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$TEMP\WindowsUpdates.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\WindowsUpdates.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2752
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2404.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1948
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2480
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2836
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2868 -s 752
      4⤵
      Loads dropped DLL
      PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp2404.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2404.tmp.bat
Size 151B
SHA256 25fe303a7ad735c5fc7721f34121225a0a8335216cf81cd02b27e0456e6d21d5
MD5 ed18918d83c613552f6e5e8f1cc8ef79
SHA1 b4eff98dd4756f7b61bd3fea9782bdc3cac04539
SHA512 737995b3e1d4cb944eef2861bf86a0c1cd3504351c9ff924a6f671d19724239c5650b2210bbc489efad28c2829f4f89edccd1c9dff3459fdbfa4feb6c787094e
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path \Users\Admin\AppData\Roaming\svchost.exe
Size 487KB
SHA256 8d2f5e538fecbbc4e1b210e46a3ff23e83d3e5d41889620a152d64e5837664f9
MD5 6ff93fe40aac2479a62a5e6a32f96aeb
SHA1 d5bdaca9eac46965b306aba3362fa81c60082d20
SHA512 151c5ddedd0df4866ebac29a75bcd88e50acf50e0087c63455ce6a1a0a706870b74a6e2c86cebf3c4221d800e2715b8fb872d71d884eabddef8e8b8b12e48d79
SSDEEP 12288:zy4elxMgArBBFxw90ZGAfYXQI7nlgMhZY5apWsjZtRupwNz:zy4eMXBsyvfYXQI7tJ7Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2480-28-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Download

memory/2480-52-0x000007FEED620000-0x000007FEEDFBD000-memory.dmp

Download

memory/2480-50-0x0000000002700000-0x0000000002780000-memory.dmp

Download

memory/2480-48-0x0000000002700000-0x0000000002780000-memory.dmp

Download

memory/2480-47-0x000007FEED620000-0x000007FEEDFBD000-memory.dmp

Download

memory/2480-41-0x000007FEED620000-0x000007FEEDFBD000-memory.dmp

Download

memory/2480-46-0x0000000002700000-0x0000000002780000-memory.dmp

Download

memory/2480-30-0x0000000001D90000-0x0000000001D98000-memory.dmp

Download

memory/2836-36-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-53-0x0000000073E70000-0x000000007455E000-memory.dmp

Download

memory/2836-27-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-59-0x00000000049C0000-0x0000000004A00000-memory.dmp

Download

memory/2836-33-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2836-58-0x0000000073E70000-0x000000007455E000-memory.dmp

Download

memory/2836-31-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-38-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-40-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-55-0x0000000077240000-0x0000000077241000-memory.dmp

Download

memory/2836-21-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2836-54-0x00000000049C0000-0x0000000004A00000-memory.dmp

Download

memory/2868-18-0x00000000000C0000-0x00000000000D6000-memory.dmp

Download

memory/2868-19-0x000007FEF4B00000-0x000007FEF54EC000-memory.dmp

Download

memory/2868-56-0x000007FEF4B00000-0x000007FEF54EC000-memory.dmp

Download

memory/2868-57-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Download

memory/2868-20-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Download

memory/2912-2-0x000000001B1E0000-0x000000001B260000-memory.dmp

Download

memory/2912-1-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

Download

memory/2912-3-0x0000000000CF0000-0x0000000000D5C000-memory.dmp

Download

memory/2912-13-0x000007FEF54F0000-0x000007FEF5EDC000-memory.dmp

Download

memory/2912-0-0x0000000001060000-0x0000000001076000-memory.dmp

Download