Malware Analysis Report

2024-08-06 13:16

Sample ID 240615-vjh9rs1hnj
Target F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263

Threat Level: Known bad

The file F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

AsyncRat

Asyncrat family

Async RAT payload

Async RAT payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 17:01

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 17:01

Reported

2024-06-15 17:03

Platform

win7-20240611-en

Max time kernel

119s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2428 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2428 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2428 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2908 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2908 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2908 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2908 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2908 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2908 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2908 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2908 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe

"C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB30A.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Sysbin.exe

"C:\Users\Admin\AppData\Roaming\Sysbin.exe"

Network

Country Destination Domain Proto
VN 61.14.233.130:7707 tcp

Files

memory/2916-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

memory/2916-1-0x00000000010A0000-0x00000000010B2000-memory.dmp

memory/2916-2-0x00000000749D0000-0x00000000750BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB30A.tmp.bat

MD5 d402cc602a36d24705d81f4ec9951d61
SHA1 a32b968e5117de80a89b89a565ca2bfbf5ee067f
SHA256 db73b5b5ffe0e7ad1c696ff6408dc4a14fab47f09c7ec0c72f5ef427b10f047c
SHA512 548dc29ed32eca4a713ed42b688ac09f7cc4c2470de47a14245d3f0f45227750a65a523aade91ebc84a6950a1ede2a9112bb4fee5a7d1f3949cb0a90a02d51b1

memory/2916-12-0x00000000749D0000-0x00000000750BE000-memory.dmp

\Users\Admin\AppData\Roaming\Sysbin.exe

MD5 36b7614f2f6b0788e6c2be5def44c68f
SHA1 0aca41d981fbc11d8eee8d7c668fc68637b4985c
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
SHA512 b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449

memory/2580-16-0x00000000011D0000-0x00000000011E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabD97F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 17:01

Reported

2024-06-15 17:03

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe C:\Windows\SysWOW64\cmd.exe
PID 652 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 652 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 652 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1424 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1424 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1424 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 652 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 652 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 652 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe

"C:\Users\Admin\AppData\Local\Temp\F5EFD1B435706C4EB87582528B1F34825765CC5324F76.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4E0B.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Sysbin.exe

"C:\Users\Admin\AppData\Roaming\Sysbin.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
VN 61.14.233.130:6606 tcp
US 8.8.8.8:53 130.233.14.61.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

memory/4888-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

memory/4888-1-0x0000000000890000-0x00000000008A2000-memory.dmp

memory/4888-2-0x0000000074E70000-0x0000000075620000-memory.dmp

memory/4888-3-0x0000000005320000-0x00000000053BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4E0B.tmp.bat

MD5 e4cecc1434189377c604100d1f4d4886
SHA1 d2ece9b83ce872e1d4046f4e7b89204e03aaa5b0
SHA256 d7f42b863009d6e07d41f49d48671c67aa85b1e7fe4af5a49d30062c3ccd4cba
SHA512 4b0c301b112fe4b7b0aa2ad10eaf7211837ea01ad09d01f2b7a58a6754c54a2902feb2edab174393d77ee4a69059be60e6b3b9b6af86fd6bf91ab2ba85881250

memory/4888-9-0x0000000074E70000-0x0000000075620000-memory.dmp

C:\Users\Admin\AppData\Roaming\Sysbin.exe

MD5 36b7614f2f6b0788e6c2be5def44c68f
SHA1 0aca41d981fbc11d8eee8d7c668fc68637b4985c
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
SHA512 b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449

memory/2764-13-0x0000000074DD0000-0x0000000075580000-memory.dmp

memory/2764-16-0x0000000006360000-0x0000000006904000-memory.dmp

memory/2764-17-0x0000000005E80000-0x0000000005EE6000-memory.dmp

memory/2764-18-0x0000000074DD0000-0x0000000075580000-memory.dmp