asyncrat | 5157d8d5c583eea41772fb99793e13f9d7e3c3c2b0eb2cd876c65d1835cc8d8f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f264ba8e4c519ce90c6e3b430945476.exe
Size 510KB
Sample240328-srwhysad77
SHA256 5157d8d5c583eea41772fb99793e13f9d7e3c3c2b0eb2cd876c65d1835cc8d8f
MD5 7f264ba8e4c519ce90c6e3b430945476
SHA1 4e18269b4c70931dcad3f7ca58e4f5db00411549
SHA512 3959fa9aad11f6718caa9404cf51cd53809d165436790109dbcf15b04ccd60335dbc824ce5e1ec0fd762c4ac69c6fb3518bc13c8a953c08cce4b7c0cb41b2cc6
SSDEEP 6144:rKeacbD2RU5+csDgVortcBiWg3cPXblkqDHd16Z6Zm5rULuW1+inHsvzUHFYWg5l:r3y1/D+McxaZvkL1pHyzWPp4xje9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat exodus_market wdkiller rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Exodus_Market

leetboy.dynuddns.net:1339

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchos.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

WDKILLER

blue.o7lab.me:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000800000002332f-15.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	7f264ba8e4c519ce90c6e3b430945476.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	start.exe

Executes dropped EXE 3 IoCs

pid	Process
4856	pop3.exe
4924	start.exe
4020	svchos.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 3224	4856	pop3.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3476	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4540	timeout.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4924	start.exe
4020	svchos.exe
4020	svchos.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	start.exe
Token: SeDebugPrivilege	3224	jsc.exe
Token: SeDebugPrivilege	4020	svchos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	svchos.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4856	3948	7f264ba8e4c519ce90c6e3b430945476.exe	97
PID 3948 wrote to memory of 4856	3948	7f264ba8e4c519ce90c6e3b430945476.exe	97
PID 3948 wrote to memory of 4924	3948	7f264ba8e4c519ce90c6e3b430945476.exe	98
PID 3948 wrote to memory of 4924	3948	7f264ba8e4c519ce90c6e3b430945476.exe	98
PID 3948 wrote to memory of 4924	3948	7f264ba8e4c519ce90c6e3b430945476.exe	98
PID 4856 wrote to memory of 4500	4856	pop3.exe	99
PID 4856 wrote to memory of 4500	4856	pop3.exe	99
PID 4856 wrote to memory of 4500	4856	pop3.exe	99
PID 4856 wrote to memory of 2756	4856	pop3.exe	100
PID 4856 wrote to memory of 2756	4856	pop3.exe	100
PID 4856 wrote to memory of 2756	4856	pop3.exe	100
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4856 wrote to memory of 3224	4856	pop3.exe	101
PID 4924 wrote to memory of 752	4924	start.exe	105
PID 4924 wrote to memory of 752	4924	start.exe	105
PID 4924 wrote to memory of 752	4924	start.exe	105
PID 4924 wrote to memory of 2236	4924	start.exe	106
PID 4924 wrote to memory of 2236	4924	start.exe	106
PID 4924 wrote to memory of 2236	4924	start.exe	106
PID 752 wrote to memory of 3476	752	cmd.exe	109
PID 752 wrote to memory of 3476	752	cmd.exe	109
PID 752 wrote to memory of 3476	752	cmd.exe	109
PID 2236 wrote to memory of 4540	2236	cmd.exe	110
PID 2236 wrote to memory of 4540	2236	cmd.exe	110
PID 2236 wrote to memory of 4540	2236	cmd.exe	110
PID 2236 wrote to memory of 4020	2236	cmd.exe	112
PID 2236 wrote to memory of 4020	2236	cmd.exe	112
PID 2236 wrote to memory of 4020	2236	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\7f264ba8e4c519ce90c6e3b430945476.exe
"C:\Users\Admin\AppData\Local\Temp\7f264ba8e4c519ce90c6e3b430945476.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\pop3.exe
  "C:\Users\Admin\AppData\Local\Temp\pop3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:2756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\Users\Admin\AppData\Local\Temp\start.exe
  "C:\Users\Admin\AppData\Local\Temp\start.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\Admin\AppData\Roaming\svchos.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C30.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4540
  - - C:\Users\Admin\AppData\Roaming\svchos.exe
      "C:\Users\Admin\AppData\Roaming\svchos.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1300 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pop3.exe

Path C:\Users\Admin\AppData\Local\Temp\pop3.exe
Size 442KB
SHA256 392ca70b63b6db8e0dc3aab0b6506169d5d9d2cad36598d037794be5a82bec09
MD5 8cd2675e19a8b1dccf0dbf082f42ab33
SHA1 3b6a8a51f53d8ec6e773f2a28f80fb003311597b
SHA512 b4260fe93196d71f38ab386a17db0ac91a1116ef155771f789579d3150b4c74abb23f289bc042ced1fe7b905f1f1645435837223b3ca331d1e1d55c7eb4a5711
SSDEEP 12288:2xdbI79je2EUyZzvUQTw/6Y378+rnoLcaQ:sFI79jDEU8vJTw/nr8SoL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

start.exe

Path C:\Users\Admin\AppData\Local\Temp\start.exe
Size 63KB
SHA256 447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759
MD5 c1ade258f05c512e98ebc4d9d1165f8a
SHA1 acf20f6a7dc7841ae06f801b887289fdc99e0488
SHA512 5b652e0ef6293d7baeb7e9d8b79322ec65e98d748e1df492099fa6692d0bbc78f032df68e7028a28af06b5c27394456159351a6469fdaf777e6eb98609331076
SSDEEP 1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp9C30.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9C30.tmp.bat
Size 150B
SHA256 e6ea770b99cd638d8c0c8601144ad041e60d0db2ad48567c1c50a517c4f11042
MD5 d9e6a2a30b3c12c5ddc58c2bb8a50ad9
SHA1 b02538e5bd641d9952d22a3120e639b8090635dd
SHA512 3b90f50a4c6a1362b001a0c03e2607c07a96c4e89e574dd52d8a45fed326bee75c2149e2eb1c2f94e4b60e271c5ce04356a1043240a186cf00be85043215161d
MD5 SHA1 SHA512

Submit Download

memory/3224-44-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/3224-34-0x0000000077C81000-0x0000000077C82000-memory.dmp

Download

memory/3224-53-0x0000000005090000-0x00000000050A0000-memory.dmp

Download

memory/3224-52-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/3224-43-0x0000000006460000-0x0000000006A04000-memory.dmp

Download

memory/3224-32-0x0000000005090000-0x00000000050A0000-memory.dmp

Download

memory/3224-29-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3224-30-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/4020-51-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

Download

memory/4020-55-0x0000000005420000-0x0000000005430000-memory.dmp

Download

memory/4020-54-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/4020-48-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/4020-49-0x0000000005420000-0x0000000005430000-memory.dmp

Download

memory/4020-50-0x0000000005B10000-0x0000000005BA2000-memory.dmp

Download

memory/4856-28-0x0000021274CA0000-0x0000021274D0A000-memory.dmp

Download

memory/4856-33-0x00007FFC3FF10000-0x00007FFC409D1000-memory.dmp

Download

memory/4856-24-0x0000021274EF0000-0x0000021274F00000-memory.dmp

Download

memory/4856-23-0x00007FFC3FF10000-0x00007FFC409D1000-memory.dmp

Download

memory/4856-22-0x00000212726F0000-0x00000212726FC000-memory.dmp

Download

memory/4924-39-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/4924-26-0x0000000073EC0000-0x0000000074670000-memory.dmp

Download

memory/4924-25-0x00000000005E0000-0x00000000005F6000-memory.dmp

Download

memory/4924-27-0x0000000004E00000-0x0000000004E10000-memory.dmp

Download

memory/4924-31-0x0000000004FB0000-0x000000000504C000-memory.dmp

Download