asyncrat | 550ffeb56ffc50ac3e2629af8ff2421411a82fbf838ac17f7c934152a7e26c19

Analysis

max time kernel
53s
max time network
64s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
31/03/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Apollo otp.exe
Size 267KB
Sample240331-pnsfcabh46
SHA256 44a89ab2537812629ee70cbc27862150f6be73a037ecfdd0f713b91445690e57
MD5 7a3c5fb54426d6e09262dc7884eb2004
SHA1 09e4ed45c5c1a749c58b119d26e9e4ad83e20dc1
SHA512 7be4e8897deba64de6e17f4c663c1d32c2b7a6c32d94041bb4dcd74cd326242f42b69690eafa884dc35ab15b39dd02384777f5353ab8074be3f39aa61da6dd92
SSDEEP 6144:XfL+oqaFpKss32sFSnTAGC7jmFlpSVxyH7lFzaB7MKMO:XfLfpKss3csj+a/ULewDO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

212.193.11.40:7707

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
rl.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3028	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 5068	308	powershell.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
308	powershell.exe
308	powershell.exe
308	powershell.exe
308	powershell.exe
308	powershell.exe
308	powershell.exe
308	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3028	4016	Apollo otp.exe	70
PID 4016 wrote to memory of 3028	4016	Apollo otp.exe	70
PID 4016 wrote to memory of 3028	4016	Apollo otp.exe	70
PID 3028 wrote to memory of 308	3028	cvtres.exe	71
PID 3028 wrote to memory of 308	3028	cvtres.exe	71
PID 3028 wrote to memory of 308	3028	cvtres.exe	71
PID 308 wrote to memory of 4704	308	powershell.exe	73
PID 308 wrote to memory of 4704	308	powershell.exe	73
PID 308 wrote to memory of 4704	308	powershell.exe	73
PID 308 wrote to memory of 4236	308	powershell.exe	74
PID 308 wrote to memory of 4236	308	powershell.exe	74
PID 308 wrote to memory of 4236	308	powershell.exe	74
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75
PID 308 wrote to memory of 5068	308	powershell.exe	75

C:\Users\Admin\AppData\Local\Temp\Apollo otp.exe
"C:\Users\Admin\AppData\Local\Temp\Apollo otp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\cvtres.exe
  C:\Users\Admin\cvtres.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:308
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4236
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sy3fqahy.g1k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sy3fqahy.g1k.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cvtres.exe

Path C:\Users\Admin\cvtres.exe
Size 6KB
SHA256 ab96c975acd27ce758174646c6d22554f3d40f1e04596fd6483cab7fbe83e1a9
MD5 335735e85b1406e2e43a766a0305da0e
SHA1 d2d3703b0394db59e58e4071e602f56402bb17eb
SHA512 484d5610d18e56c0615cb1a6941309903341f870e5e5b95604c36f00383b40283094403c3e63bee1cbf10d6d5dfcc0d9c02f3a14879c455a3f9498cb5673eac0
SSDEEP 96:vEW2q2IwhEJzVFKA5lCwIpwn+gGFQzyOoq9TkzNt:MW8hKBUA54MNGfOo+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 242KB
SHA256 d5f5ffdb04adb138c29ef5cf7a7cce58a7a830481036c321ff3d1537bebf78dc
MD5 9bbe96004bffd7a4e63c16c5e035349a
SHA1 7e0bfa435417c144d4b21dd0c148174fc6b60764
SHA512 601433db6c78538bf49201a204a055b3016eb4a5df11d2f0a9efac1a9ad7545b103acbd0d8ff130e8a16231ceb152dd6050cbd9a12ee9ddc6cf06f73832c401e
SSDEEP 6144:vd56+Vjt56dsJiiB9+Fid9p67FrR9RiKxCLQZFjcCz:vHfj36ETpwl7xUwxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.ps1

Path C:\Users\Admin\temp.ps1
Size 1KB
SHA256 27f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
MD5 5e817bbd9ef2f8821aa0283b20a51923
SHA1 102ca518d89653fb400636e660fa3fc276235c5c
SHA512 f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e
MD5 SHA1 SHA512

Submit Download

temp_.bat

Path C:\Users\Admin\temp_.bat
Size 242KB
SHA256 f27549972766fa9949e27551669cd77c012d78cb67d7312ef22b633de74c2b14
MD5 f69cd6d2ea5d42e55b781698182c9e73
SHA1 9dfd53f47c3dbd7a6eef420bdf156761dbdbe568
SHA512 90ebfe56632ef4a81bc474d7ea5a146436b4b2e8eb51e41977847890026abca33baed867cf61b1c8176247f2b15fc10c9183136420be68b2613ed42755ab092a
SSDEEP 3072:O3QQYarhMDKWWOnQYCHLDSKYtKViujLetFnZRlqklW9qMWfD1nBXc950Qw72kKRM:O1d3fOnlC/QcjgnokwunBg2QPRFKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp_.ps1

Path C:\Users\Admin\temp_.ps1
Size 1KB
SHA256 86af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
MD5 5a0a8376c0e45cc25d4050920cee3dcc
SHA1 2de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA512 f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0
MD5 SHA1 SHA512

Submit Download

memory/308-18-0x0000000007510000-0x0000000007B38000-memory.dmp

Download

memory/308-43-0x0000000009400000-0x0000000009422000-memory.dmp

Download

memory/308-17-0x0000000004A00000-0x0000000004A10000-memory.dmp

Download

memory/308-15-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/308-19-0x0000000007490000-0x00000000074B2000-memory.dmp

Download

memory/308-20-0x0000000007D90000-0x0000000007DF6000-memory.dmp

Download

memory/308-21-0x0000000007BB0000-0x0000000007C16000-memory.dmp

Download

memory/308-22-0x0000000007E00000-0x0000000008150000-memory.dmp

Download

memory/308-23-0x0000000007D60000-0x0000000007D7C000-memory.dmp

Download

memory/308-24-0x0000000008620000-0x000000000866B000-memory.dmp

Download

memory/308-25-0x0000000008550000-0x00000000085C6000-memory.dmp

Download

memory/308-14-0x0000000004A50000-0x0000000004A86000-memory.dmp

Download

memory/308-67-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/308-41-0x0000000009650000-0x00000000096E4000-memory.dmp

Download

memory/308-42-0x00000000093B0000-0x00000000093CA000-memory.dmp

Download

memory/308-16-0x0000000004A00000-0x0000000004A10000-memory.dmp

Download

memory/308-44-0x0000000009CC0000-0x000000000A1BE000-memory.dmp

Download

memory/308-49-0x000000000A840000-0x000000000AEB8000-memory.dmp

Download

memory/308-56-0x00000000771B1000-0x00000000772C4000-memory.dmp

Download

memory/308-51-0x0000000009820000-0x0000000009876000-memory.dmp

Download

memory/308-52-0x0000000009A40000-0x0000000009A5E000-memory.dmp

Download

memory/308-54-0x0000000004A00000-0x0000000004A10000-memory.dmp

Download

memory/308-55-0x0000000009730000-0x000000000973A000-memory.dmp

Download

memory/3028-6-0x0000000000740000-0x0000000000748000-memory.dmp

Download

memory/3028-64-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/3028-7-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/3028-69-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/5068-61-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5068-65-0x0000000073070000-0x000000007375E000-memory.dmp

Download

memory/5068-70-0x0000000073070000-0x000000007375E000-memory.dmp

Download