asyncrat | 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5 | Triage™

Resubmissions

09/04/2024, 19:34

240409-yakb9afg7910

31/03/2024, 23:04

240331-22j3cafb2410

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installation Guide.exe
Size 44KB
Sample240409-yakb9afg79
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat evasion persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000700000002a726-3.dat	family_asyncrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

pid	Process
3008	attrib.exe
2980	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
976	$77pdf.pif

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\sysfig\\$77pdf.pif\""	Installation Guide.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
1	discord.com
2	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2032	schtasks.exe
4680	schtasks.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
4492	timeout.exe
572	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
3352	Installation Guide.exe
976	$77pdf.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3352	Installation Guide.exe
Token: SeDebugPrivilege	976	$77pdf.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
976	$77pdf.pif

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3008	3352	Installation Guide.exe	78
PID 3352 wrote to memory of 3008	3352	Installation Guide.exe	78
PID 3352 wrote to memory of 2980	3352	Installation Guide.exe	80
PID 3352 wrote to memory of 2980	3352	Installation Guide.exe	80
PID 3352 wrote to memory of 3876	3352	Installation Guide.exe	82
PID 3352 wrote to memory of 3876	3352	Installation Guide.exe	82
PID 3876 wrote to memory of 4492	3876	cmd.exe	84
PID 3876 wrote to memory of 4492	3876	cmd.exe	84
PID 3876 wrote to memory of 976	3876	cmd.exe	85
PID 3876 wrote to memory of 976	3876	cmd.exe	85
PID 976 wrote to memory of 4120	976	$77pdf.pif	87
PID 976 wrote to memory of 4120	976	$77pdf.pif	87
PID 976 wrote to memory of 2032	976	$77pdf.pif	89
PID 976 wrote to memory of 2032	976	$77pdf.pif	89
PID 976 wrote to memory of 920	976	$77pdf.pif	91
PID 976 wrote to memory of 920	976	$77pdf.pif	91
PID 976 wrote to memory of 4680	976	$77pdf.pif	93
PID 976 wrote to memory of 4680	976	$77pdf.pif	93
PID 976 wrote to memory of 3704	976	$77pdf.pif	96
PID 976 wrote to memory of 3704	976	$77pdf.pif	96
PID 976 wrote to memory of 1624	976	$77pdf.pif	98
PID 976 wrote to memory of 1624	976	$77pdf.pif	98
PID 3704 wrote to memory of 3500	3704	cmd.exe	100
PID 3704 wrote to memory of 3500	3704	cmd.exe	100
PID 1624 wrote to memory of 572	1624	cmd.exe	101
PID 1624 wrote to memory of 572	1624	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

pid	Process
3008	attrib.exe
2980	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe
"C:\Users\Admin\AppData\Local\Temp\Installation Guide.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3008
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E63.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4492
- - C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
    "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:4120
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77pdf.pif" /TR "C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif \"\$77pdf.pif\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2032
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77pdf.pif
      4⤵
      PID:920
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "pdf_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
      4⤵
      Creates scheduled task(s)
      PID:4680
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "$77pdf_Task"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "$77pdf_Task"
        5⤵
        
        PID:3500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp99E9.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp99E9.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp99E9.tmp.bat
Size 248B
SHA256 c6e350df4796e68adb5191b7a8ed3ea5852234988579bd46cf19792c877c0822
MD5 7ffa06e321e45066754fde05d8e77827
SHA1 456b9d5a1229fb4c01263a434833fd8678b316f7
SHA512 f4f2a69141ed221de831f745292618b158ee3e416b95abd11413e68d6a3267a067870bcef7ab4ca0cd9f83f5472a9d8b6093dfc6737092e539430b09b994720d
MD5 SHA1 SHA512

Submit Download

tmp9E63.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9E63.tmp.bat
Size 157B
SHA256 9d4f3e391c5d3371f22db36c197ab65bfa169159edf7ae1e4df8c6a039216f13
MD5 1bd069984ed1566abda790ab3851f750
SHA1 7a5f278fc8dc9ca0a10b91a9305263b90f0760db
SHA512 bdb95a0dd9b06e5b9fb07698b4084ca860367bc2654be016cd2067b10f95d9249e345c7842edca528abb574e97b1f1ea8c860b77aa81c42b2d627ee4d31c4eb4
MD5 SHA1 SHA512

Submit Download

$77pdf.pif

Path C:\Users\Admin\AppData\Roaming\sysfig\$77pdf.pif
Size 44KB
SHA256 36a2d67cd549aa66de37db248de5c056b00c0e04ef37729144ef3195fd2cbed5
MD5 723e7f52d0db11a69edf56c19e2adc6c
SHA1 83037cee1636f96f0854bdf2fd335b5693f9c54b
SHA512 364ecf4cdb44061a19f4fd9bf3a40b546e46b977d7c44c2635147757a9566a67e016c986455b05e45fe82f60d266a698f938616fb2ee5056466c2b5f2e48bbf1
SSDEEP 768:yjHC5v1a5zjcuW/KQlnHphD/W/RUTV9PPK/z1QB6SRm1fvr0VFE:yjHC57uJQlHpxwG59W1QoSufwVFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/976-15-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download

memory/976-11-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download

memory/976-12-0x000000001B830000-0x000000001B840000-memory.dmp

Download

memory/976-16-0x000000001B830000-0x000000001B840000-memory.dmp

Download

memory/976-17-0x000000001C0F0000-0x000000001C110000-memory.dmp

Download

memory/976-22-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download

memory/3352-4-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download

memory/3352-2-0x000000001BB20000-0x000000001BB30000-memory.dmp

Download

memory/3352-9-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download

memory/3352-0-0x0000000000D50000-0x0000000000D62000-memory.dmp

Download

memory/3352-1-0x00007FFA40610000-0x00007FFA410D2000-memory.dmp

Download