asyncrat | 4f166ddf1cb703473aab067ef7042038b536a0c7c81803e8a29545e20d800cac

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
Size 541KB
Sample240401-xshqpsdc73
SHA256 4f166ddf1cb703473aab067ef7042038b536a0c7c81803e8a29545e20d800cac
MD5 7805a09ce37e152a4f15d00fb0364097
SHA1 7495d1fe9125e0fb7ad46fc3d05397a1937a3964
SHA512 33b0c41fa0b17e36576864d349cf778f0a4fcb9cd8fcce18d9cfd01182e35d76f3996bd7311de45af03aa47ab254ad8fd00579f84cdd3ce3ebb27c3f1f6cf41a
SSDEEP 12288:ATqZ4xjyW0zKfxK1W/wuYBZbBsVSydsrfhMieqk:KqZ4dyT+Z6BsV9oPS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat sept evasion persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Sept

chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49746
chonglee575.duckdns.org:2703
chonglee575.duckdns.org:49746

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\firefox.exe\","	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002320f-7.dat	Nirsoft

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 2 IoCs

pid	Process
3188	AdvancedRun.exe
1756	AdvancedRun.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2604	sc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
3188	AdvancedRun.exe
3188	AdvancedRun.exe
3188	AdvancedRun.exe
3188	AdvancedRun.exe
1756	AdvancedRun.exe
1756	AdvancedRun.exe
1756	AdvancedRun.exe
1756	AdvancedRun.exe
3156	powershell.exe
3156	powershell.exe
1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
Token: SeDebugPrivilege	3188	AdvancedRun.exe
Token: SeImpersonatePrivilege	3188	AdvancedRun.exe
Token: SeDebugPrivilege	1756	AdvancedRun.exe
Token: SeImpersonatePrivilege	1756	AdvancedRun.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	2208	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3188	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	98
PID 1620 wrote to memory of 3188	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	98
PID 1620 wrote to memory of 3188	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	98
PID 1620 wrote to memory of 1756	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	102
PID 1620 wrote to memory of 1756	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	102
PID 1620 wrote to memory of 1756	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	102
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105
PID 1620 wrote to memory of 2208	1620	7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe	105

C:\Users\Admin\AppData\Local\Temp\7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2604
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\Users\Admin\AppData\Local\Temp\7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7805a09ce37e152a4f15d00fb0364097_JaffaCakes118.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

AdvancedRun.exe

Path C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
Size 88KB
SHA256 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
MD5 17fc12902f4769af3a9271eb4e2dacce
SHA1 9a4a1581cc3971579574f837e110f3bd6d529dab
SHA512 036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
SSDEEP 1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_fo2itmec.sdr.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_fo2itmec.sdr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1620-0-0x0000000000C60000-0x0000000000CEC000-memory.dmp

Download

memory/1620-1-0x0000000074E80000-0x0000000075630000-memory.dmp

Download

memory/1620-2-0x00000000054E0000-0x0000000005550000-memory.dmp

Download

memory/1620-3-0x0000000074E80000-0x0000000075630000-memory.dmp

Download

memory/1620-4-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/1620-5-0x00000000056F0000-0x0000000005706000-memory.dmp

Download

memory/1620-30-0x0000000074E80000-0x0000000075630000-memory.dmp

Download

memory/2208-26-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2208-39-0x00000000065C0000-0x0000000006B64000-memory.dmp

Download

memory/2208-42-0x00000000052E0000-0x00000000052F0000-memory.dmp

Download

memory/2208-41-0x0000000074E80000-0x0000000075630000-memory.dmp

Download

memory/2208-29-0x0000000074E80000-0x0000000075630000-memory.dmp

Download

memory/2208-40-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/2208-38-0x0000000005F70000-0x000000000600C000-memory.dmp

Download

memory/2208-35-0x00000000052E0000-0x00000000052F0000-memory.dmp

Download

memory/3156-34-0x00007FFBED5D0000-0x00007FFBEE091000-memory.dmp

Download

memory/3156-31-0x0000013D56120000-0x0000013D56130000-memory.dmp

Download

memory/3156-24-0x0000013D56120000-0x0000013D56130000-memory.dmp

Download

memory/3156-16-0x0000013D6E740000-0x0000013D6E762000-memory.dmp

Download

memory/3156-21-0x00007FFBED5D0000-0x00007FFBEE091000-memory.dmp

Download

memory/3156-23-0x0000013D56120000-0x0000013D56130000-memory.dmp

Download