asyncrat | 9410861cbe8204310017cdec72056d49f8effbe26961cc6cb73fee37c731e0a0

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MartDrum.exe
Size 904KB
Sample240528-bbbp6sge71
SHA256 9410861cbe8204310017cdec72056d49f8effbe26961cc6cb73fee37c731e0a0
MD5 1e4352c43b8c5a6b5a10dd0ace9a57a4
SHA1 6d4f220bdfee34df0b3b9d8a829dd423fab5abdf
SHA512 ac96916f4c42acbf8be07d814dbc15e04c50e3874888ebdb3d762f74fcac58e4e100da68a34d78da12403ee09f3bf59c681bf3fa258de8e39e1038b5fc42e7a9
SSDEEP 12288:Fy3S2m4omcLCRdCPiofcsdS3c2qRWi2kx6RAaiPjMoxIlDhI4HPlRoQ9RT9tQ6DP:FyhM1LAdCKo0s6xrkxJxjDIldBHdRvfb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat load_man rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Load_Man

leetman.dynuddns.com:1337

Mutex

AsyncMutex_6SI8asdasd2casOkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2196 created 3424	2196	Fighting.pif	56
PID 2196 created 3424	2196	Fighting.pif	56
PID 2196 created 3424	2196	Fighting.pif	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	MartDrum.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2196	Fighting.pif
2788	jsc.exe
4428	jsc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1168	tasklist.exe
8	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2368	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif
4428	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	8	tasklist.exe
Token: SeDebugPrivilege	4428	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2196	Fighting.pif
2196	Fighting.pif
2196	Fighting.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4428	jsc.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3396	3100	MartDrum.exe	83
PID 3100 wrote to memory of 3396	3100	MartDrum.exe	83
PID 3100 wrote to memory of 3396	3100	MartDrum.exe	83
PID 3396 wrote to memory of 3640	3396	cmd.exe	85
PID 3396 wrote to memory of 3640	3396	cmd.exe	85
PID 3396 wrote to memory of 3640	3396	cmd.exe	85
PID 3640 wrote to memory of 1168	3640	cmd.exe	87
PID 3640 wrote to memory of 1168	3640	cmd.exe	87
PID 3640 wrote to memory of 1168	3640	cmd.exe	87
PID 3640 wrote to memory of 4340	3640	cmd.exe	88
PID 3640 wrote to memory of 4340	3640	cmd.exe	88
PID 3640 wrote to memory of 4340	3640	cmd.exe	88
PID 3640 wrote to memory of 8	3640	cmd.exe	91
PID 3640 wrote to memory of 8	3640	cmd.exe	91
PID 3640 wrote to memory of 8	3640	cmd.exe	91
PID 3640 wrote to memory of 1108	3640	cmd.exe	92
PID 3640 wrote to memory of 1108	3640	cmd.exe	92
PID 3640 wrote to memory of 1108	3640	cmd.exe	92
PID 3640 wrote to memory of 5076	3640	cmd.exe	94
PID 3640 wrote to memory of 5076	3640	cmd.exe	94
PID 3640 wrote to memory of 5076	3640	cmd.exe	94
PID 3640 wrote to memory of 2344	3640	cmd.exe	95
PID 3640 wrote to memory of 2344	3640	cmd.exe	95
PID 3640 wrote to memory of 2344	3640	cmd.exe	95
PID 3640 wrote to memory of 2352	3640	cmd.exe	96
PID 3640 wrote to memory of 2352	3640	cmd.exe	96
PID 3640 wrote to memory of 2352	3640	cmd.exe	96
PID 3640 wrote to memory of 2196	3640	cmd.exe	97
PID 3640 wrote to memory of 2196	3640	cmd.exe	97
PID 3640 wrote to memory of 2196	3640	cmd.exe	97
PID 3640 wrote to memory of 2368	3640	cmd.exe	98
PID 3640 wrote to memory of 2368	3640	cmd.exe	98
PID 3640 wrote to memory of 2368	3640	cmd.exe	98
PID 2196 wrote to memory of 4516	2196	Fighting.pif	99
PID 2196 wrote to memory of 4516	2196	Fighting.pif	99
PID 2196 wrote to memory of 4516	2196	Fighting.pif	99
PID 2196 wrote to memory of 2788	2196	Fighting.pif	110
PID 2196 wrote to memory of 2788	2196	Fighting.pif	110
PID 2196 wrote to memory of 2788	2196	Fighting.pif	110
PID 2196 wrote to memory of 4428	2196	Fighting.pif	111
PID 2196 wrote to memory of 4428	2196	Fighting.pif	111
PID 2196 wrote to memory of 4428	2196	Fighting.pif	111
PID 2196 wrote to memory of 4428	2196	Fighting.pif	111
PID 2196 wrote to memory of 4428	2196	Fighting.pif	111

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\MartDrum.exe
  "C:\Users\Admin\AppData\Local\Temp\MartDrum.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k cmd < Tunisia & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:4340
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe"
        5⤵
        
        PID:1108
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 28955
        5⤵
        
        PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Cock + Enhance + Forest + Grocery + Mall 28955\Fighting.pif
        5⤵
        
        PID:2344
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Amd + Backed 28955\Q
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\Fighting.pif
        
        28955\Fighting.pif 28955\Q
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2196
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Innovations\PoseidonSense.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & exit
  2⤵
  - Drops startup file
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\jsc.exe
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\jsc.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\jsc.exe
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\jsc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fighting.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\Fighting.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\Q
Size 523KB
SHA256 4e6c63fe5b8faa26ddc90f7183bac516ff42d7148d7ba8cdcfd816b37ea340e2
MD5 c6d3af61f6a8b9e9cc3c0997243cbc8d
SHA1 e99aa1b98ab1baeeb82365fd6f76e99d0417f67b
SHA512 08f9b3b6925c7da20bdd870d6c3de1ac4df680f43b8bf19e4a03d5a240b435d396918ea206a54668952a41fc25466606f18ab2972f4c4ca17083b13680933138
SSDEEP 12288:+iR4JiiiIV1xDfEip6NiOsLiRiokQi4iFj5B:J40+1xDfz6m5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsc.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\28955\jsc.exe
Size 46KB
SHA256 39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5
MD5 94c8e57a80dfca2482dedb87b93d4fd9
SHA1 5729e6c7d2f5ab760f0093b9d44f8ac0f876a803
SHA512 1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc
SSDEEP 768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Amd
Size 461KB
SHA256 48a39ed8fcac7eea85635bff545ea72b9bb741a33affc3cfdc1d9513ad466d9b
MD5 3bfbfcf6dde8162276981a6c818526fc
SHA1 2359fc484c7ff2e40d2b0e5a58abafc39a2f534f
SHA512 68962d58896c6971a1c6411121a1c9723b511096828576c7b3333d4eec7d248bb11585964811219f436e599c52d4c13fa992e2fc369c82f1eb7c8f628a0e0adf
SSDEEP 12288:+iR4JiiiIV1xDfEip6NiOsLiRiokQi4iFj5P:J40+1xDfz6m5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Backed

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Backed
Size 62KB
SHA256 4052bb73dc0b19224a815c89ba44728868ff3d7ccd4ba888c5a3deeeea1ba75c
MD5 bc332c8625f154764139eebc5543d265
SHA1 2114287c7d17b25b6cb18250dca0ad1d3be1badf
SHA512 367f4ad92cd1aee6d76aed2d1cb670c3a059bc826eae30632f8db5754ce32677248d705bb3cd61dfb1db56c781b73bf0f7728c345d808c9a839a7360fabc64d6
SSDEEP 768:Vn2gmIcz5ORmb4wZ7T8O+4MmBfdb0ULKEMcNO/wL7CRxcSccJcco0c0:VTczP4wJ8ODMoqUMcNAhXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cock

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cock
Size 245KB
SHA256 4b4fa7e6aa4e413577040eed27ab1b8295e0f019ca4007dedf5d131bacb8c86a
MD5 3250d6f3cef2fa42d8144d7300c94a9a
SHA1 fb41f4b16da0c326d4f994fd69a95148740db16c
SHA512 b19361ae089fe0fff1e0f6ef995ed9fdb76c08df329ee95cf6845a61362027e18378bf4951a67e55c7da13a3f184d3b613a91ac0d7f613163523a4ea1da63c21
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12k:LO0z8e0lvSr0Wyw20K4mqCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enhance

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Enhance
Size 129KB
SHA256 9d0a82b1d0302bd357ada65073f63b79bcffacfd687941fb66b879e51dbc7e6f
MD5 2eaf3dde860d1fa5cb576a067d88e0c9
SHA1 f731f073975e880445e63ab7130b9d6b35e030e4
SHA512 cc230393bc0b8256b5132882eaa53c8e749b74b5bcf4aec2f3cb6c6f417433da24ac54744d825dff14993cd0ccc17c4d76e128b3e76597809e11aaebfb795df0
SSDEEP 3072:yqRWO/9EAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz0:yqlEAehuqN8zwNzlmhPL1b5nZ20
MD5 SHA1 SHA512 SSDEEP

Submit Download

Forest

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Forest
Size 215KB
SHA256 b691b133ac132727cc615e39d09e7db00e179ffcfe4b7939de169042ce3b8a5c
MD5 cbd44c7f5d1ffca6b785ac5610c584a2
SHA1 0d3c42631251b1256c61f2b499ff2dcee141955a
SHA512 246d9d66564d10e80958d1a6796e4d8ee28549f9d8b0a161ee929d7b9d3a740a0befcd81efc8d20092ff2fb802c50e9581a7e290988550931a5341c1a1545c67
SSDEEP 6144:eZ6lfA6Gfm608DsvqJX4xNAB+xHFq9O0lHPOGUWR:eZ6XKmNvqJWNAB+X0lHPOGJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Grocery

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Grocery
Size 154KB
SHA256 7a4f7c61b90f5e0c6467eef51446cbccaf8e410117f4ec2dad6b400cdc3be9ee
MD5 7a10d8c21d509285032ccc39be8ca70a
SHA1 c94f9e1239f669a720f05712a536d443dcfb87d6
SHA512 eda1f6a3b085801c3f55a622612bb1a9260477c435fa68ab8c9e6b77316dabac2a17d574422990282ac699eac9275b92d5051fee902fefe243ff22e8a0e42c55
SSDEEP 3072:RhxjRYH/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbPD:RhxjRYmFqZvEAOz04pmdVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mall

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mall
Size 181KB
SHA256 64402cf5b891e266e8736340b70202796110ff53a0bc63034434b8feef1c3eb4
MD5 cc937c80427292e3f084280877637c6c
SHA1 e5e958447df0e571f194848d9c570ea9568f9665
SHA512 8b70a42aaa091f0ce1694052504e53f8db4d02a7290c251b33373dfab4a8fa334e05226755ec7bd96594f9ace60e3625e8481a2dc34c9e410b11b55958691a93
SSDEEP 3072:L6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:L64EgarxUaBZ2myoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tunisia

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tunisia
Size 12KB
SHA256 f593d273036a2db89a963774319942d27d7de6718033988297b5220e4566037b
MD5 89d7b6fab91c718d1eb98295746b0e0e
SHA1 12933edc9d0d0812f7eb6240468a5ba03d92ceb4
SHA512 41d036fa81ebf2680c24bc240e40b62a5008b1a5daaac714e3bd86bc4784e54719c4cbd0377aa984e08db0fbab8e1db84b86b7f257df3b50d505645f42b70046
SSDEEP 384:eYjRGHT6zN2lbGaMV9JLPtTFJ3OhH/FVhFK8Va:dwzacsV9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4428-39-0x0000000001360000-0x0000000001376000-memory.dmp

Download

memory/4428-42-0x0000000006120000-0x00000000066C4000-memory.dmp

Download

memory/4428-43-0x0000000005D60000-0x0000000005DF2000-memory.dmp

Download

memory/4428-44-0x0000000005D50000-0x0000000005D5A000-memory.dmp

Download

memory/4428-47-0x0000000007170000-0x000000000720C000-memory.dmp

Download

memory/4428-48-0x0000000007210000-0x0000000007276000-memory.dmp

Download