Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 23:09
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240220-en
General
-
Target
AsyncClient.exe
-
Size
48KB
-
MD5
0712481ec7be68e2f67672b911aebf23
-
SHA1
527ceb23db13a4e84b5f27a850116bb1421981dd
-
SHA256
6a26dc7c12eddcdc36e00ca1633eb4f231a433deee4f574122c51690f28a3e67
-
SHA512
bce33d4a59624ccee236df8b3ff061bd58377dee284e44849471e7afdd9baf7845a91dc9701647ce9290ea13c3f18ca2bda780dce646a28b3c1436ad78d248cd
-
SSDEEP
768:/uwhFTAY3IQWUe9jqmo2qLwjbovXejeM8emPISZrul5UrM0bfg02Gzd6jq7eDZyG:/uwhFTA4/2pjboOehAgruYrfbfAGzMqQ
Malware Config
Extracted
asyncrat
0.5.8
Default
report-dust.gl.at.ply.gg:28329
report-dust.gl.at.ply.gg:8188
9VMpESMh922h
-
delay
3
-
install
true
-
install_file
Svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001dae6-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
pid Process 4336 Svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4708 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2132 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe 3380 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3380 AsyncClient.exe Token: SeDebugPrivilege 4336 Svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3380 wrote to memory of 400 3380 AsyncClient.exe 88 PID 3380 wrote to memory of 400 3380 AsyncClient.exe 88 PID 3380 wrote to memory of 400 3380 AsyncClient.exe 88 PID 3380 wrote to memory of 4904 3380 AsyncClient.exe 90 PID 3380 wrote to memory of 4904 3380 AsyncClient.exe 90 PID 3380 wrote to memory of 4904 3380 AsyncClient.exe 90 PID 400 wrote to memory of 4708 400 cmd.exe 92 PID 400 wrote to memory of 4708 400 cmd.exe 92 PID 400 wrote to memory of 4708 400 cmd.exe 92 PID 4904 wrote to memory of 2132 4904 cmd.exe 93 PID 4904 wrote to memory of 2132 4904 cmd.exe 93 PID 4904 wrote to memory of 2132 4904 cmd.exe 93 PID 4904 wrote to memory of 4336 4904 cmd.exe 94 PID 4904 wrote to memory of 4336 4904 cmd.exe 94 PID 4904 wrote to memory of 4336 4904 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Svchost" /tr '"C:\Users\Admin\AppData\Roaming\Svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Svchost" /tr '"C:\Users\Admin\AppData\Roaming\Svchost.exe"'3⤵
- Creates scheduled task(s)
PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp703E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2132
-
-
C:\Users\Admin\AppData\Roaming\Svchost.exe"C:\Users\Admin\AppData\Roaming\Svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD51c6805d42cc4d4a280f742529cee9291
SHA107a7e626cf87a9431d390f108d2a533c26c08354
SHA256b8d0e9548593ed257b42c15c21831df5f4c5708ba50cdf8c0d6bc54f0a163543
SHA5121818b72086861a750f542885af84641c358cba49ea7c3f8a4d17ae857ed3f02599b4a0afbc9714b0400989a88c65bb5f178a3af844d59253da114ecb40af927a
-
Filesize
48KB
MD50712481ec7be68e2f67672b911aebf23
SHA1527ceb23db13a4e84b5f27a850116bb1421981dd
SHA2566a26dc7c12eddcdc36e00ca1633eb4f231a433deee4f574122c51690f28a3e67
SHA512bce33d4a59624ccee236df8b3ff061bd58377dee284e44849471e7afdd9baf7845a91dc9701647ce9290ea13c3f18ca2bda780dce646a28b3c1436ad78d248cd