asyncrat | 723f394531d5ce4b66af4ff751d53bf1c299f1e939a5e10a62f6a25c633f55e3

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
async4.ps1
Size 701KB
Sample240626-nhdvbssdle
SHA256 723f394531d5ce4b66af4ff751d53bf1c299f1e939a5e10a62f6a25c633f55e3
MD5 c3d53f9c721f8108dc5054bf346def12
SHA1 158b58b1f8183707e156dfb041d54445b2390003
SHA512 8f5bae0a4911f40bb9d035b7c2d3960d91b09df84bdb2590be0844e76436f9e2e54816bf9610578ba538e2546e86b13312ee93ac13bb6045ff1f0a28d4df699b
SSDEEP 12288:o+x48PQ0D1VF5sh0cxAl6WKoesVGAq2pzydR:o848PQ0D1b53cxASR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default execution rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Default

geneish.mywire.org:6606
geneish.mywire.org:7707
geneish.mywire.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3996 set thread context of 4108	3996	powershell.exe	83

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe
3996	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1164	powershell.exe
1164	powershell.exe
3996	powershell.exe
3996	powershell.exe
4108	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	4108	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3996	1164	powershell.exe	82
PID 1164 wrote to memory of 3996	1164	powershell.exe	82
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83
PID 3996 wrote to memory of 4108	3996	powershell.exe	83

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\async4.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\VVLASCOISPRUQYVBBNHTJG.ps1'"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VVLASCOISPRUQYVBBNHTJG.ps1

Path C:\ProgramData\VVLASCOISPRUQYVBBNHTJG.ps1
Size 699KB
SHA256 61cf1772d3bf1ca44c92a42b8e8529ceae85264d168a064cd5f4d437a8aa66f8
MD5 43ce61f53e99ea34c1e13337e2c1335b
SHA1 01c387ace3eac788a00e132289f14bbc0e6afb36
SHA512 40ffe1b7b7b7c819f984e0791d8aeae7e0df756836a04788f216b2d571cc44416000e8f2b8507d39cb9c3cbb40115aa6c42ef9dfb66bdcca212aae254fcce59f
SSDEEP 12288:d+x48PQ0D1VF5sh0cxAl6WKoesVGAq2pzydg:d848PQ0D1b53cxASg
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8
MD5 906a96ab3d13d754809f312628f6e4ac
SHA1 4f1f3d49c788e5736c31904eaf4683ea4e8683c6
SHA512 a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 496B
SHA256 b5642f35a3243b34424e486a067dec8731da12ea9ae47edb1b9ec5560a7f4d95
MD5 5a32bedb5424879ab5aba88c2b13a9a7
SHA1 b61b8970b81873846879ae69af722d5c582faac9
SHA512 25e92fe2e87febde31c46aca0988088d5817b95c172ff7e624cc84adff7e4402d17b8d78bd9232311c77e21de88673d14cc90465a4ffddc92341201d97f5e782
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_u4fjr2ak.vxu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4fjr2ak.vxu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1164-0-0x00007FFFE9CF3000-0x00007FFFE9CF5000-memory.dmp

Download

memory/1164-6-0x000001457AF40000-0x000001457AF62000-memory.dmp

Download

memory/1164-11-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/1164-12-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/1164-72-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/3996-52-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-44-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-34-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-64-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-60-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-58-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-20-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/3996-56-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-54-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-28-0x000002F0ADFC0000-0x000002F0ADFE8000-memory.dmp

Download

memory/3996-50-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-48-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-46-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-30-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-42-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-38-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-36-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-32-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-62-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-40-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-29-0x000002F0ADFC0000-0x000002F0ADFE1000-memory.dmp

Download

memory/3996-68-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/3996-26-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/3996-25-0x00007FFFE9CF0000-0x00007FFFEA7B1000-memory.dmp

Download

memory/4108-65-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4108-73-0x0000000005110000-0x00000000056B4000-memory.dmp

Download

memory/4108-74-0x0000000004D00000-0x0000000004D92000-memory.dmp

Download

memory/4108-75-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Download