asyncrat | 08f8498aec75418bb4c12972a6547ee2c4762160e7bf36c558a91b7b9110ed3f

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
712940BAEF78C821E36B8701BF073C52.exe
Size 91KB
Sample240419-lmax5adh82
SHA256 08f8498aec75418bb4c12972a6547ee2c4762160e7bf36c558a91b7b9110ed3f
MD5 712940baef78c821e36b8701bf073c52
SHA1 d59896b87424fafc0d00ab5e5c2019bd941167ce
SHA512 68bc6df413e00e6420ee6db6e4d0497bab61908b96f48fdb6bf6aae9bed72de840d83dfc0017dd24995a05f29b415b82852f84e9b74de85d303b67cc396c7007
SSDEEP 1536:qoJFOWbLXbbetrgpFZ2nrWLtyEclopV4c78eiV:zFOWbLLbetrgQn6BpVD34
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8 - Customized by Mikewaals

Botnet

Default

204.12.199.30:6606
204.12.199.30:7707
204.12.199.30:8808

Mutex

Bbtt03i3Zbxo

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Downloads MZ/PE file

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 2748	3916	Accounts_Ledger_Software.eXE	100

Executes dropped EXE 3 IoCs

pid	Process
3916	Accounts_Ledger_Software.eXE
4576	Accounts_Ledger_Software.eXE
4332	Accounts_Ledger_Software.eXE

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3696	SCHtAsKs.EXe
4792	SCHtAsKs.EXe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
112	712940BAEF78C821E36B8701BF073C52.exe
112	712940BAEF78C821E36B8701BF073C52.exe
112	712940BAEF78C821E36B8701BF073C52.exe
112	712940BAEF78C821E36B8701BF073C52.exe
112	712940BAEF78C821E36B8701BF073C52.exe
112	712940BAEF78C821E36B8701BF073C52.exe
3916	Accounts_Ledger_Software.eXE
3916	Accounts_Ledger_Software.eXE
3916	Accounts_Ledger_Software.eXE
3916	Accounts_Ledger_Software.eXE
4576	Accounts_Ledger_Software.eXE
4576	Accounts_Ledger_Software.eXE
4332	Accounts_Ledger_Software.eXE
4332	Accounts_Ledger_Software.eXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	712940BAEF78C821E36B8701BF073C52.exe
Token: SeDebugPrivilege	3916	Accounts_Ledger_Software.eXE
Token: SeDebugPrivilege	2748	aspnet_compiler.exe
Token: SeDebugPrivilege	4576	Accounts_Ledger_Software.eXE
Token: SeDebugPrivilege	4332	Accounts_Ledger_Software.eXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 3696	112	712940BAEF78C821E36B8701BF073C52.exe	90
PID 112 wrote to memory of 3696	112	712940BAEF78C821E36B8701BF073C52.exe	90
PID 112 wrote to memory of 3696	112	712940BAEF78C821E36B8701BF073C52.exe	90
PID 112 wrote to memory of 2152	112	712940BAEF78C821E36B8701BF073C52.exe	94
PID 112 wrote to memory of 2152	112	712940BAEF78C821E36B8701BF073C52.exe	94
PID 112 wrote to memory of 2152	112	712940BAEF78C821E36B8701BF073C52.exe	94
PID 3916 wrote to memory of 4792	3916	Accounts_Ledger_Software.eXE	96
PID 3916 wrote to memory of 4792	3916	Accounts_Ledger_Software.eXE	96
PID 3916 wrote to memory of 4792	3916	Accounts_Ledger_Software.eXE	96
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100
PID 3916 wrote to memory of 2748	3916	Accounts_Ledger_Software.eXE	100

C:\Users\Admin\AppData\Local\Temp\712940BAEF78C821E36B8701BF073C52.exe
"C:\Users\Admin\AppData\Local\Temp\712940BAEF78C821E36B8701BF073C52.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\SCHtAsKs.EXe
  "SCHtAsKs.EXe" /create /tn WindowsUpdates62766459 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 09:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:3696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2152

C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\SCHtAsKs.EXe
  "SCHtAsKs.EXe" /create /tn WindowsUpdates62766459 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 09:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accounts_Ledger_Software.eXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Accounts_Ledger_Software.eXE.log
Size 1KB
SHA256 15835a01fa04e5654c6d8ea22ec8ce3b36b8ad114a2851b322724847e04cb9e6
MD5 290b783420a3638b2f341f46e6fb563d
SHA1 1d74ecf967490c0b579086ff4f65b6bf1360adc6
SHA512 3aab90dead03cb1cae9b12b0bdcb4d86b29923d34133dba655ac6fd8e9783a3baa3edc7af2fc75930d86a884b940e8163babacd0cadf04a8418732be87ffba84
MD5 SHA1 SHA512

Submit Download

Accounts_Ledger_Software.eXE

Path C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE
Size 91KB
SHA256 08f8498aec75418bb4c12972a6547ee2c4762160e7bf36c558a91b7b9110ed3f
MD5 712940baef78c821e36b8701bf073c52
SHA1 d59896b87424fafc0d00ab5e5c2019bd941167ce
SHA512 68bc6df413e00e6420ee6db6e4d0497bab61908b96f48fdb6bf6aae9bed72de840d83dfc0017dd24995a05f29b415b82852f84e9b74de85d303b67cc396c7007
SSDEEP 1536:qoJFOWbLXbbetrgpFZ2nrWLtyEclopV4c78eiV:zFOWbLLbetrgQn6BpVD34
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-0-0x0000000000F70000-0x0000000000F8A000-memory.dmp

Download

memory/112-1-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/112-2-0x0000000005D30000-0x00000000062D4000-memory.dmp

Download

memory/112-3-0x00000000059C0000-0x00000000059D0000-memory.dmp

Download

memory/112-5-0x00000000072B0000-0x00000000072BA000-memory.dmp

Download

memory/112-6-0x0000000007360000-0x00000000073FC000-memory.dmp

Download

memory/112-8-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/2748-13-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2748-16-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/2748-17-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/2748-18-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/2748-19-0x00000000053A0000-0x00000000053B0000-memory.dmp

Download

memory/3916-12-0x0000000004B80000-0x0000000004B90000-memory.dmp

Download

memory/3916-15-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/3916-11-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/4332-26-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/4332-27-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/4576-22-0x0000000074690000-0x0000000074E40000-memory.dmp

Download

memory/4576-23-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Download

memory/4576-24-0x0000000074690000-0x0000000074E40000-memory.dmp

Download