asyncrat | 147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974.msi
Size 1.5MB
Sample240426-bdn4aagf2t
SHA256 147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974
MD5 6d3f68d31efc5fc456850af228427c25
SHA1 487fcaaab61ce4e76d6a1e2568cf3602a5f6632b
SHA512 e1c26181065ad69078e281154f741d318ceec9d412c030a89397e6d27ff89c224ed7f106b68892f41309264830e48255ff114369985206efe9c5311f8725df3d
SSDEEP 24576:kt9cpVDhOXLcVXyEq9GRhv9cWP8rtPN01Mq7+xtA+w9TxDfoUBoiGt+eWilfdqF6:jpRhOXLcJyEq9GRhvVqtV01Mq7kctDAo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat mafiaexe discovery rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

mafiaexe

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
twinks234.duckdns.org:6606
twinks234.duckdns.org:7707
twinks234.duckdns.org:8808

Mutex

mafiaEXE

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0007000000023464-66.dat	family_asyncrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023464-66.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/620-68-0x0000000000FB0000-0x00000000010F0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects file containing reversed ASEP Autorun registry keys 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023461-59.dat	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral2/files/0x0007000000023464-66.dat	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral2/memory/620-68-0x0000000000FB0000-0x00000000010F0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5072	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e578aac.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BE13E8ED-EE1E-41EA-93EE-21B2B781511E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B38.tmp	msiexec.exe
File created	C:\Windows\Installer\e578aac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

pid	Process
620	mafiachroom.exe

Loads dropped DLL 1 IoCs

pid	Process
3964	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007b8d05dfffe7e78e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007b8d05df0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007b8d05df000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7b8d05df000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007b8d05df00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3368	msiexec.exe
3368	msiexec.exe
620	mafiachroom.exe
620	mafiachroom.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4680	msiexec.exe
Token: SeSecurityPrivilege	3368	msiexec.exe
Token: SeCreateTokenPrivilege	4680	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4680	msiexec.exe
Token: SeLockMemoryPrivilege	4680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4680	msiexec.exe
Token: SeMachineAccountPrivilege	4680	msiexec.exe
Token: SeTcbPrivilege	4680	msiexec.exe
Token: SeSecurityPrivilege	4680	msiexec.exe
Token: SeTakeOwnershipPrivilege	4680	msiexec.exe
Token: SeLoadDriverPrivilege	4680	msiexec.exe
Token: SeSystemProfilePrivilege	4680	msiexec.exe
Token: SeSystemtimePrivilege	4680	msiexec.exe
Token: SeProfSingleProcessPrivilege	4680	msiexec.exe
Token: SeIncBasePriorityPrivilege	4680	msiexec.exe
Token: SeCreatePagefilePrivilege	4680	msiexec.exe
Token: SeCreatePermanentPrivilege	4680	msiexec.exe
Token: SeBackupPrivilege	4680	msiexec.exe
Token: SeRestorePrivilege	4680	msiexec.exe
Token: SeShutdownPrivilege	4680	msiexec.exe
Token: SeDebugPrivilege	4680	msiexec.exe
Token: SeAuditPrivilege	4680	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4680	msiexec.exe
Token: SeChangeNotifyPrivilege	4680	msiexec.exe
Token: SeRemoteShutdownPrivilege	4680	msiexec.exe
Token: SeUndockPrivilege	4680	msiexec.exe
Token: SeSyncAgentPrivilege	4680	msiexec.exe
Token: SeEnableDelegationPrivilege	4680	msiexec.exe
Token: SeManageVolumePrivilege	4680	msiexec.exe
Token: SeImpersonatePrivilege	4680	msiexec.exe
Token: SeCreateGlobalPrivilege	4680	msiexec.exe
Token: SeBackupPrivilege	3292	vssvc.exe
Token: SeRestorePrivilege	3292	vssvc.exe
Token: SeAuditPrivilege	3292	vssvc.exe
Token: SeBackupPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	620	mafiachroom.exe
Token: SeBackupPrivilege	4280	srtasks.exe
Token: SeRestorePrivilege	4280	srtasks.exe
Token: SeSecurityPrivilege	4280	srtasks.exe
Token: SeTakeOwnershipPrivilege	4280	srtasks.exe
Token: SeBackupPrivilege	4280	srtasks.exe
Token: SeRestorePrivilege	4280	srtasks.exe
Token: SeSecurityPrivilege	4280	srtasks.exe
Token: SeTakeOwnershipPrivilege	4280	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4680	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
620	mafiachroom.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4280	3368	msiexec.exe	105
PID 3368 wrote to memory of 4280	3368	msiexec.exe	105
PID 3368 wrote to memory of 3964	3368	msiexec.exe	107
PID 3368 wrote to memory of 3964	3368	msiexec.exe	107
PID 3368 wrote to memory of 3964	3368	msiexec.exe	107
PID 3964 wrote to memory of 5072	3964	MsiExec.exe	108
PID 3964 wrote to memory of 5072	3964	MsiExec.exe	108
PID 3964 wrote to memory of 5072	3964	MsiExec.exe	108
PID 3964 wrote to memory of 3608	3964	MsiExec.exe	110
PID 3964 wrote to memory of 3608	3964	MsiExec.exe	110
PID 3964 wrote to memory of 3608	3964	MsiExec.exe	110
PID 3964 wrote to memory of 620	3964	MsiExec.exe	112
PID 3964 wrote to memory of 620	3964	MsiExec.exe	112
PID 3964 wrote to memory of 620	3964	MsiExec.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3372F7FCE40893856A4BFC1D7AE54E28
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:5072
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\files\mafiachroom.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\files\mafiachroom.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\files.cab
Size 1.2MB
SHA256 943ef4c71d53ef383ee9591d460799c7e503e493c26abdd6ded50eb82f2dd47f
MD5 d4e7f05d7f6a7dc75f468dbcaa9f437f
SHA1 f377284434b0200c6ebeba730dfcddaff7f2de13
SHA512 9f8d960ee4367f388a0717b9a3991682a900f13db547dd51242a6c1686a2d9badbb94446db36700116c0c7753daacc7fb43ec35c09e94bc462e74c36e2b86bf5
SSDEEP 24576:TLcVXyEq9GRhv9cWP8rtPN01Mq7+xtA+w9TxDfoUBoiGt+eWilfdqFWVgK:TLcJyEq9GRhvVqtV01Mq7kctDAUdGHWZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mafiachroom.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\files\mafiachroom.exe
Size 1.2MB
SHA256 1cf774a50175eb7321b1366c585ccfc68bdf0916d8e78edf1fe24e079209eb9e
MD5 6e7ebd37b6095cb1a2f3ffa9d5598c81
SHA1 d4d0cfa65f6dd224af16ff81a29abdf6ab0eab69
SHA512 f23d689393db2f8292018d8b303992b19dd8b9cfd4f226a84ddd70d30ec2d89083e9b1418d5f82e04a1a81d9014387e0450747b99a02fc32e094c987cc2c782b
SSDEEP 24576:1lcVkyEq9DRho1jFP8ltPP01Ws7+wFPEl9ix4fpUzoQDt+egElxdqFWVvQ:1lcCyEq9DRho/ctH01Ws74rA4RUBDHgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\msiwrapper.ini
Size 1KB
SHA256 63d198b37e94012d08626c8f81c889a9ef2919071a492b79c102da0ea6b7b0f9
MD5 2925ea25360f901e723756d1f5e288e1
SHA1 8e968c54feddcd79ade57d9491b7cb0562a51945
SHA512 5d5aae7af833b99098b1ea78cb1ca8b60ab0f19c7809c3c9f350944667a6e75a552ee4014b4c420a2df3c3eaa708171946142eeffd56fd34458b07d677373073
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-5ffcf07d-3c99-4866-8a34-8eda26e77c38\msiwrapper.ini
Size 1KB
SHA256 185483378b5c3382acf985917be7ec64a069a245334877979f0fa2c124a10e3e
MD5 4a3e48408dc0b19e0a8052196717d42f
SHA1 9aa070c944233f713dc8584f6739f3d617bac58d
SHA512 d594431ed9dc99e1fb529f0da2581dfa2783253b816e51cad2c17af77b64c13e6fffbb9798e50fdd8d20268811a50f46c73a4a3d5f3559d4ca669db8d4ba116d
MD5 SHA1 SHA512

Submit Download

MSI8B38.tmp

Path C:\Windows\Installer\MSI8B38.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.7MB
SHA256 1a7c4d2d5b79cdefa39d163b7e4cd47ba13c92f79b4a8055252a981f0629b739
MD5 bd58ecfc9b3a9b11194e95f1e2182c50
SHA1 babebe0715d51c3a82da954422add3d5431ab85a
SHA512 c191094cf5db14c790a205dfa6ae1362ba63c6bb4050cf5c07d55e4254564da92af0133496db800c3e6c036e155f6a317f88afa32c171caa574432abb06b1423
SSDEEP 24576:oSqm41xrdoO/vvTLkXHugHW3Eko51AaajjH9Z8wW62qb207WIxlIr6XCg:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3d92fcb6-119b-44a7-a81b-556b4e8d930e}_OnDiskSnapshotProp

Path \??\Volume{df058d7b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3d92fcb6-119b-44a7-a81b-556b4e8d930e}_OnDiskSnapshotProp
Size 6KB
SHA256 038a4389e5ff439ea691d4a343e9511ce47fd1508af627212e283fe02663b460
MD5 0a5e84458d4cef78ac0695a473600da1
SHA1 8b2e10bff239527971b7b7febc3f1c217b0aa907
SHA512 d34c766ea6ae655a3c7f165115524a4934366c750b59a26ee89fc26ee9331f4be2ed9e7d6074911d1777198b660f10c28b3ca1948fa7d7e7b1252d8f71a457a6
SSDEEP 96:FzAZVZM4xDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ylb++1VmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-69-0x00000000728D0000-0x0000000073080000-memory.dmp

Download

memory/620-71-0x0000000006240000-0x00000000067E4000-memory.dmp

Download

memory/620-72-0x0000000005E80000-0x0000000005F12000-memory.dmp

Download

memory/620-73-0x0000000006010000-0x000000000601A000-memory.dmp

Download

memory/620-70-0x0000000003520000-0x0000000003530000-memory.dmp

Download

memory/620-68-0x0000000000FB0000-0x00000000010F0000-memory.dmp

Download

memory/620-76-0x00000000728D0000-0x0000000073080000-memory.dmp

Download

memory/620-77-0x0000000003520000-0x0000000003530000-memory.dmp

Download