Malware Analysis Report

2025-01-02 12:09

Sample ID 240419-rbmqfaeb62
Target ClientSetup.exe
SHA256 f0031fd209a7a4c94b50ea20aaad11f62f4db0e847d63312190fec4cf8d77deb
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0031fd209a7a4c94b50ea20aaad11f62f4db0e847d63312190fec4cf8d77deb

Threat Level: Known bad

The file ClientSetup.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

AsyncRat

Asyncrat family

Async RAT payload

Async RAT payload

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 14:01

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 14:01

Reported

2024-04-19 14:04

Platform

win7-20240215-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Setup.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\C11Setup.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C11Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\System32\cmd.exe
PID 2220 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\System32\cmd.exe
PID 2220 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\System32\cmd.exe
PID 2220 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\system32\cmd.exe
PID 2220 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\system32\cmd.exe
PID 2220 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2984 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2984 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2608 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\C11Setup.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\C11Setup.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\C11Setup.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe

"C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "C11Setup" /tr '"C:\Users\Admin\AppData\Local\Temp\C11Setup.exe"' & exit

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1258.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "C11Setup" /tr '"C:\Users\Admin\AppData\Local\Temp\C11Setup.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\C11Setup.exe

"C:\Users\Admin\AppData\Local\Temp\C11Setup.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:4330 tcp
N/A 127.0.0.1:4330 tcp
N/A 192.168.1.5:4040 tcp
N/A 192.168.1.5:4040 tcp
N/A 127.0.0.1:4330 tcp
N/A 192.168.1.5:4040 tcp
N/A 192.168.1.5:4040 tcp
N/A 192.168.1.5:4040 tcp
N/A 127.0.0.1:4330 tcp
N/A 192.168.1.5:4040 tcp

Files

memory/2220-0-0x00000000010A0000-0x00000000010E4000-memory.dmp

memory/2220-1-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

memory/2220-3-0x000000001AEA0000-0x000000001AF20000-memory.dmp

memory/2220-4-0x0000000077760000-0x0000000077909000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1258.tmp.bat

MD5 9884fddbd356e07e54335dcf7750db6a
SHA1 b924a0cc907c022cc539cc3bd80abc30c6d20b26
SHA256 83d9dddd49e7c07ef94488afd9fdc1d1fc244370d51e2b189c03b0982b9cae03
SHA512 bbd15c2a526fb959f3d75c5ea09ebbd58af3d9587f945b33ae6b56890b2871d887cd587fac5f400d691183cf76f212e141df7a3d1653f60276ce15f692a84ef2

memory/2220-13-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

memory/2220-14-0x0000000077760000-0x0000000077909000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C11Setup.exe

MD5 a91750c64ba9c895f06cfe10938c9995
SHA1 634180ea1b57441ca0e65db5a0b3cc93e22d1d60
SHA256 f0031fd209a7a4c94b50ea20aaad11f62f4db0e847d63312190fec4cf8d77deb
SHA512 886d6920c4307c664f87fccddc9beabb9ecfad2e3b2700fece35f36c4e38a311b08ae80bddd8566880964d3d9632283732e2c24c92b5212a2f811e5e2d20c1a9

memory/2640-19-0x0000000000AC0000-0x0000000000B04000-memory.dmp

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

memory/2640-21-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

memory/2640-22-0x000000001AF20000-0x000000001AFA0000-memory.dmp

memory/2640-23-0x0000000077760000-0x0000000077909000-memory.dmp

memory/2640-24-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

memory/2640-25-0x000000001AF20000-0x000000001AFA0000-memory.dmp

memory/2640-26-0x0000000077760000-0x0000000077909000-memory.dmp