Malware Analysis Report

2024-08-06 13:15

Sample ID 240616-bzhtdsxgln
Target f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263

Threat Level: Known bad

The file f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

Async RAT payload

AsyncRat

Detects file containing reversed ASEP Autorun registry keys

Detects file containing reversed ASEP Autorun registry keys

Async RAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Delays execution with timeout.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 01:34

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 01:34

Reported

2024-06-16 01:37

Platform

win7-20240508-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2216 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2216 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2216 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2376 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2376 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2376 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2376 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2376 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2376 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2376 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 2376 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe

"C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2E03.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Sysbin.exe

"C:\Users\Admin\AppData\Roaming\Sysbin.exe"

Network

Country Destination Domain Proto
VN 61.14.233.130:8808 tcp
VN 61.14.233.130:6606 tcp
VN 61.14.233.130:6606 tcp
VN 61.14.233.130:7707 tcp
VN 61.14.233.130:8808 tcp
VN 61.14.233.130:7707 tcp

Files

memory/2220-0-0x000000007473E000-0x000000007473F000-memory.dmp

memory/2220-1-0x0000000000D10000-0x0000000000D22000-memory.dmp

memory/2220-2-0x0000000074730000-0x0000000074E1E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2E03.tmp.bat

MD5 5742a687e2c8f18a47cdf63b482077dc
SHA1 91d893f9d000b6aa34c92626945a553198dd6352
SHA256 fac72b7c8aa5d102c649ef3dedee84c03b8d3acdbf75136a9d6ff807cc5e8517
SHA512 9b15cd47fde7466f36ee0a02bfad7437cb811f395e2e455f7e0091f823f897cffea338cf44e14c06962f4b0ae04099d0a4fa3b38f653441daf93731ac58405df

memory/2220-12-0x0000000074730000-0x0000000074E1E000-memory.dmp

\Users\Admin\AppData\Roaming\Sysbin.exe

MD5 36b7614f2f6b0788e6c2be5def44c68f
SHA1 0aca41d981fbc11d8eee8d7c668fc68637b4985c
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
SHA512 b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449

memory/2664-16-0x0000000000FD0000-0x0000000000FE2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 01:34

Reported

2024-06-16 01:37

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Detects file containing reversed ASEP Autorun registry keys

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysbin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 992 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 892 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 892 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5060 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5060 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5060 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5060 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 5060 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe
PID 5060 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Sysbin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe

"C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp569C.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Sysbin.exe

"C:\Users\Admin\AppData\Roaming\Sysbin.exe"

Network

Country Destination Domain Proto
VN 61.14.233.130:6606 tcp
VN 61.14.233.130:7707 tcp
VN 61.14.233.130:6606 tcp
VN 61.14.233.130:6606 tcp
VN 61.14.233.130:7707 tcp
VN 61.14.233.130:6606 tcp

Files

memory/992-0-0x000000007477E000-0x000000007477F000-memory.dmp

memory/992-1-0x0000000000A30000-0x0000000000A42000-memory.dmp

memory/992-2-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/992-3-0x0000000005490000-0x000000000552C000-memory.dmp

memory/992-8-0x0000000074770000-0x0000000074F20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp569C.tmp.bat

MD5 2350673d9cf0e6361bd49ca8053bc593
SHA1 c130a9d8ab15c5f6e05e7a452b315875b95f04cb
SHA256 08ccedec51b78da223f7473bbe0124dc5751b5da3ae1d821b7e6e8871a5f76d2
SHA512 b4130bbb6448ea7b2f9622ab89a5d1feec783122e63d2493b85211ccd0543e8f91b2f6b62c5fae61d8a0fce6b931f8a5c12c4631538231eee218dde32cec5135

C:\Users\Admin\AppData\Roaming\Sysbin.exe

MD5 36b7614f2f6b0788e6c2be5def44c68f
SHA1 0aca41d981fbc11d8eee8d7c668fc68637b4985c
SHA256 f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
SHA512 b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449

memory/1964-13-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/1964-14-0x00000000746C0000-0x0000000074E70000-memory.dmp