asyncrat | d7c2f3e3d806f37f3b511e8a0ade1b000b30761bf3f96adc92235e134387b2ce

General

Target

AsyncClient.exe
Size

52KB
MD5

f5a2b23f785fb2eee6724b41b812b206
SHA1

4d9142e9a7280e4df3ddf309c253531b0aa66b2f
SHA256

d7c2f3e3d806f37f3b511e8a0ade1b000b30761bf3f96adc92235e134387b2ce
SHA512

39c5b0ebf80b77b5b65a224e9e069cb1407d362149ee9478c83f3fb0d412bc462804e2f63b0a7579844dee9abb47a714b5b550d554fe9ef4d26f76b75f84c0e4
SSDEEP

1536:GuK59THfe2nElVmsxQhcbZm+M+7wbDjd31YGqMx:GuK3THfe2iVmsxQhcbZfM+SILMx

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

6knTUdMwFO0b

Attributes

delay
3
install
true
install_file
vortext.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/s14cUU5G

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00090000000004fe-12.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	vortext.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	pastebin.com
32	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4308	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4484	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe
3372	AsyncClient.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	AsyncClient.exe
Token: SeDebugPrivilege	3484	vortext.exe
Token: SeDebugPrivilege	3484	vortext.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2848	3372	AsyncClient.exe	95
PID 3372 wrote to memory of 2848	3372	AsyncClient.exe	95
PID 3372 wrote to memory of 2848	3372	AsyncClient.exe	95
PID 3372 wrote to memory of 1996	3372	AsyncClient.exe	97
PID 3372 wrote to memory of 1996	3372	AsyncClient.exe	97
PID 3372 wrote to memory of 1996	3372	AsyncClient.exe	97
PID 1996 wrote to memory of 4484	1996	cmd.exe	99
PID 1996 wrote to memory of 4484	1996	cmd.exe	99
PID 1996 wrote to memory of 4484	1996	cmd.exe	99
PID 2848 wrote to memory of 4308	2848	cmd.exe	100
PID 2848 wrote to memory of 4308	2848	cmd.exe	100
PID 2848 wrote to memory of 4308	2848	cmd.exe	100
PID 1996 wrote to memory of 3484	1996	cmd.exe	102
PID 1996 wrote to memory of 3484	1996	cmd.exe	102
PID 1996 wrote to memory of 3484	1996	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortext" /tr '"C:\Users\Admin\AppData\Roaming\vortext.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "vortext" /tr '"C:\Users\Admin\AppData\Roaming\vortext.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2E6E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4484
- - C:\Users\Admin\AppData\Roaming\vortext.exe
    "C:\Users\Admin\AppData\Roaming\vortext.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2E6E.tmp.bat

Filesize
151B

MD5
1bd6754498a909d5356ff8b3048e0663

SHA1
6941f79cf6821521e5d2e9cbb7cc47b95e78bc3d

SHA256
a685681764ce79a6bb28445f74bb7c750d7d22c47724b51b190248cdafb620dc

SHA512
5ac0d5cbbbeb58a70432fe5e6ac475608dc498f68f5bc15ef5adb7284c3112460d24c9bb30077bd876a05a05acfaef5c5f75ea3d7118c5bd68cb8151da084d06

Download Submit
C:\Users\Admin\AppData\Roaming\vortext.exe

Filesize
52KB

MD5
f5a2b23f785fb2eee6724b41b812b206

SHA1
4d9142e9a7280e4df3ddf309c253531b0aa66b2f

SHA256
d7c2f3e3d806f37f3b511e8a0ade1b000b30761bf3f96adc92235e134387b2ce

SHA512
39c5b0ebf80b77b5b65a224e9e069cb1407d362149ee9478c83f3fb0d412bc462804e2f63b0a7579844dee9abb47a714b5b550d554fe9ef4d26f76b75f84c0e4

Download Submit
memory/3372-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/3372-1-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/3372-2-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/3372-3-0x0000000004F30000-0x0000000004F96000-memory.dmp

Filesize
408KB

Download
memory/3372-4-0x00000000053C0000-0x000000000545C000-memory.dmp

Filesize
624KB

Download
memory/3372-10-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/3484-14-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/3484-15-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads