asyncrat | 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5 | Triage™

Resubmissions

09/04/2024, 19:34

240409-yakb9afg7910

31/03/2024, 23:04

240331-22j3cafb2410

Analysis

max time kernel
134s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/04/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installation Guide.exe
Size 44KB
Sample240409-yakb9afg79
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat evasion rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001ac22-3.dat	family_asyncrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

pid	Process
596	attrib.exe
4532	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
3716	$77pdf.pif

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
2	discord.com
3	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
4648	schtasks.exe
836	schtasks.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
1964	timeout.exe
2360	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3900	Installation Guide.exe
3716	$77pdf.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	Installation Guide.exe
Token: SeDebugPrivilege	3716	$77pdf.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3716	$77pdf.pif

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4532	3900	Installation Guide.exe	73
PID 3900 wrote to memory of 4532	3900	Installation Guide.exe	73
PID 3900 wrote to memory of 596	3900	Installation Guide.exe	75
PID 3900 wrote to memory of 596	3900	Installation Guide.exe	75
PID 3900 wrote to memory of 192	3900	Installation Guide.exe	77
PID 3900 wrote to memory of 192	3900	Installation Guide.exe	77
PID 192 wrote to memory of 1964	192	cmd.exe	79
PID 192 wrote to memory of 1964	192	cmd.exe	79
PID 192 wrote to memory of 3716	192	cmd.exe	80
PID 192 wrote to memory of 3716	192	cmd.exe	80
PID 3716 wrote to memory of 2844	3716	$77pdf.pif	82
PID 3716 wrote to memory of 2844	3716	$77pdf.pif	82
PID 3716 wrote to memory of 4648	3716	$77pdf.pif	84
PID 3716 wrote to memory of 4648	3716	$77pdf.pif	84
PID 3716 wrote to memory of 96	3716	$77pdf.pif	86
PID 3716 wrote to memory of 96	3716	$77pdf.pif	86
PID 3716 wrote to memory of 836	3716	$77pdf.pif	88
PID 3716 wrote to memory of 836	3716	$77pdf.pif	88
PID 3716 wrote to memory of 3288	3716	$77pdf.pif	91
PID 3716 wrote to memory of 3288	3716	$77pdf.pif	91
PID 3716 wrote to memory of 3584	3716	$77pdf.pif	93
PID 3716 wrote to memory of 3584	3716	$77pdf.pif	93
PID 3288 wrote to memory of 2340	3288	cmd.exe	95
PID 3288 wrote to memory of 2340	3288	cmd.exe	95
PID 3584 wrote to memory of 2360	3584	cmd.exe	96
PID 3584 wrote to memory of 2360	3584	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

pid	Process
596	attrib.exe
4532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe
"C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4532
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB815.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:192
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1964
- - C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
    "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:2844
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77pdf.pif" /TR "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif \"\$77pdf.pif\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4648
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:96
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "pdf_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
      4⤵
      Creates scheduled task(s)
      PID:836
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "$77pdf_Task"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "$77pdf_Task"
        5⤵
        
        PID:2340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB011.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB011.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB011.tmp.bat
Size 248B
SHA256 6fc5bbb914dd89b86fd1e12bdc58712bd03fbeebdbda81562cbbbba142e8265d
MD5 378aa1c394e1e1e10d9051bdc7405b5d
SHA1 e850042039dc32fc0ceeceedbe6c459a0bb3e6a8
SHA512 5646d4b612089f94f368f8bd0fd771c17398035a844f5ff8a5ee72baa4c6faa2516dfdbbc22b7107ca34b883f1fe0ecc9dabbf44ad805744fb6e2747687cfeaf
MD5 SHA1 SHA512

Submit Download

tmpB815.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB815.tmp.bat
Size 157B
SHA256 1158a616cddb130ff80b0b92f67f204d52add5e15ea35a208f15b05e9482e6ce
MD5 4c94b4c733dbc69b639f6cd1ed1826ad
SHA1 f046eb0b9144f349a7d163c17ecbabbfe248bc14
SHA512 ccff0cb79339a0a8b5a90c7d09320e9f4ba49658a4d48c426f5f32e76847373be4c39dcdfa70f2567620ba1b3ea74644dd47684dc0c2b60313174c08efee8a2d
MD5 SHA1 SHA512

Submit Download

$77pdf.pif

Path C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
Size 44KB
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3716-13-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download

memory/3716-11-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download

memory/3716-12-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Download

memory/3716-14-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Download

memory/3716-15-0x000000001C160000-0x000000001C180000-memory.dmp

Download

memory/3716-19-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download

memory/3900-4-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download

memory/3900-2-0x0000000000B40000-0x0000000000B50000-memory.dmp

Download

memory/3900-9-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download

memory/3900-0-0x0000000000240000-0x0000000000252000-memory.dmp

Download

memory/3900-1-0x00007FFC8AAB0000-0x00007FFC8B49C000-memory.dmp

Download