asyncrat | 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5

Resubmissions

09/04/2024, 19:34

240409-yakb9afg7910

31/03/2024, 23:04

240331-22j3cafb2410

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installation Guide.exe
Size 44KB
Sample240409-yakb9afg79
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat evasion persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x0008000000023326-3.dat	family_asyncrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
404	attrib.exe
4376	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	Installation Guide.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	$77pdf.pif

Executes dropped EXE 1 IoCs

pid	Process
3580	$77pdf.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\sysfig\\$77pdf.pif\""	Installation Guide.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
40	discord.com
41	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3196	schtasks.exe
4280	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4768	timeout.exe
632	timeout.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
2932	Installation Guide.exe
3580	$77pdf.pif
3580	$77pdf.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	Installation Guide.exe
Token: SeDebugPrivilege	3580	$77pdf.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3580	$77pdf.pif

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 404	2932	Installation Guide.exe	95
PID 2932 wrote to memory of 404	2932	Installation Guide.exe	95
PID 2932 wrote to memory of 4376	2932	Installation Guide.exe	97
PID 2932 wrote to memory of 4376	2932	Installation Guide.exe	97
PID 2932 wrote to memory of 3548	2932	Installation Guide.exe	111
PID 2932 wrote to memory of 3548	2932	Installation Guide.exe	111
PID 3548 wrote to memory of 632	3548	cmd.exe	113
PID 3548 wrote to memory of 632	3548	cmd.exe	113
PID 3548 wrote to memory of 3580	3548	cmd.exe	114
PID 3548 wrote to memory of 3580	3548	cmd.exe	114
PID 3580 wrote to memory of 4940	3580	$77pdf.pif	116
PID 3580 wrote to memory of 4940	3580	$77pdf.pif	116
PID 3580 wrote to memory of 4280	3580	$77pdf.pif	118
PID 3580 wrote to memory of 4280	3580	$77pdf.pif	118
PID 3580 wrote to memory of 5060	3580	$77pdf.pif	120
PID 3580 wrote to memory of 5060	3580	$77pdf.pif	120
PID 3580 wrote to memory of 3196	3580	$77pdf.pif	122
PID 3580 wrote to memory of 3196	3580	$77pdf.pif	122
PID 3580 wrote to memory of 2492	3580	$77pdf.pif	128
PID 3580 wrote to memory of 2492	3580	$77pdf.pif	128
PID 3580 wrote to memory of 4064	3580	$77pdf.pif	129
PID 3580 wrote to memory of 4064	3580	$77pdf.pif	129
PID 4064 wrote to memory of 4768	4064	cmd.exe	132
PID 4064 wrote to memory of 4768	4064	cmd.exe	132
PID 2492 wrote to memory of 2608	2492	cmd.exe	133
PID 2492 wrote to memory of 2608	2492	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
404	attrib.exe
4376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe
"C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:404
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC851.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:632
- - C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
    "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:4940
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77pdf.pif" /TR "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif \"\$77pdf.pif\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4280
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:5060
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "pdf_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
      4⤵
      Creates scheduled task(s)
      PID:3196
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "$77pdf_Task"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "$77pdf_Task"
        5⤵
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB36D.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:8
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB36D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB36D.tmp.bat
Size 248B
SHA256 70c460795453b65654d955a1dbf5b32486e4390e5141439bef618ca52e651e69
MD5 9d897273c0ed527c93837fd6f7a4a49b
SHA1 1b069b0d7ebd1ca8ce9c269e541ca4ca6564029b
SHA512 2bf410de4eb75755d44bdecdddc6a94d77d61929afa9b756f1e94fc7c80dcf41af034d2d650a025c955bbc2e538989a6550d7951cc2a8ae4678a60351bab4ae4
MD5 SHA1 SHA512

Submit Download

tmpC851.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC851.tmp.bat
Size 157B
SHA256 a559e96e55918e8832d3d317ab960d141bff87ff84448c0b69c6fc9e68879145
MD5 c823b89b0e74ccca0de36e52fc39a85c
SHA1 c7fa886ad02514eb2ac1c8795717a6b7bb7626e4
SHA512 96f5f74ded47166b8246ebda377dd50bfe0e47b4979ecbe63d87fd1a82c8cb36400d85282d09bbacf32221825e951a8c6da4dde8a07e8ffe641a25541e78d867
MD5 SHA1 SHA512

Submit Download

$77pdf.pif

Path C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
Size 44KB
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2932-9-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download

memory/2932-4-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download

memory/2932-2-0x0000000002720000-0x0000000002730000-memory.dmp

Download

memory/2932-0-0x0000000000570000-0x0000000000582000-memory.dmp

Download

memory/2932-1-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download

memory/3580-11-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download

memory/3580-12-0x000000001B170000-0x000000001B180000-memory.dmp

Download

memory/3580-15-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download

memory/3580-16-0x000000001B170000-0x000000001B180000-memory.dmp

Download

memory/3580-17-0x000000001C0A0000-0x000000001C0C0000-memory.dmp

Download

memory/3580-22-0x00007FF9F63A0000-0x00007FF9F6E61000-memory.dmp

Download