asyncrat | 1731919d2dc81ad27833aaaf162c923c8c0e9ec12f0517c7db0409b74e9550c6

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/Empyrean Removal Tool.exe
Size

495KB
MD5

0858df720da731fb05cfa980134fa639
SHA1

0e5e7bf34494892b20e2ed62cea218ada919361d
SHA256

4af251cefa5fbdfb07cff0be7ba01cd6f525099949dac28b5780876a4942d810
SHA512

c2f06ec22f57876b4ed168536bba76b7121962bb752d2a244eea3a37b68044837bf4263b5e3812a4ec1cf5b235653b3f389bbeefef89f609ae5af0eb1e847eb9
SSDEEP

12288:r6iLGC/KU7T+q1/t5moY4MHJgOvK2xqTCzqkfuxHn:rDVyWT+Y/t0oY4MKiK20T8fux

Score

10^/10

asyncrat quasar xworm default slave execution rat spyware trojan

Malware Config

Extracted

Family

xworm

best-bird.gl.at.ply.gg:27196

super-nearest.gl.at.ply.gg:17835

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

stop-largely.gl.at.ply.gg:27116

Mutex

$Sxr-kl1r656AGsPQksTmi8

Attributes

encryption_key
ql4fQ8TV9ZFP9vRX2myA
install_name
$sxr~Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$77STARTUP~MSF
subdirectory
$sxr~SubDir

Extracted

Family

asyncrat

Botnet

Default

finally-grande.gl.at.ply.gg:25844

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral11/files/0x000c000000012286-5.dat	family_xworm
behavioral11/files/0x00060000000190da-19.dat	family_xworm
behavioral11/memory/1968-17-0x0000000000DA0000-0x0000000000DB8000-memory.dmp	family_xworm
behavioral11/memory/2760-22-0x0000000000F20000-0x0000000000F3A000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral11/files/0x0031000000015d12-12.dat	family_quasar
behavioral11/memory/2608-26-0x0000000000A40000-0x0000000000AAC000-memory.dmp	family_quasar
behavioral11/memory/1636-64-0x0000000001390000-0x00000000013FC000-memory.dmp	family_quasar
behavioral11/memory/2212-76-0x00000000001F0000-0x000000000025C000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral11/files/0x0006000000018bed-24.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2364	powershell.exe
1956	powershell.exe
1976	powershell.exe
1036	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
1968	Part 1.exe
2608	Part 2.exe
2760	Part 4.exe
2624	Part 3.exe
1636	Part 2.exe
2212	Part 2.exe

Loads dropped DLL 2 IoCs

pid	Process
820	cmd.exe
2832	cmd.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	ip-api.com
2	ip-api.com
7	ip-api.com
8	ip-api.com
14	api.ipify.org
25	ip-api.com
32	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2844	PING.EXE
944	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1804	schtasks.exe
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1956	powershell.exe
1976	powershell.exe
1968	Part 1.exe
1036	powershell.exe
2364	powershell.exe
2760	Part 4.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	Part 2.exe
Token: SeDebugPrivilege	2624	Part 3.exe
Token: SeDebugPrivilege	1968	Part 1.exe
Token: SeDebugPrivilege	2760	Part 4.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1968	Part 1.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2760	Part 4.exe
Token: SeDebugPrivilege	1636	Part 2.exe
Token: SeDebugPrivilege	2212	Part 2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1968	Part 1.exe
2760	Part 4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1968	1252	Empyrean Removal Tool.exe	28
PID 1252 wrote to memory of 1968	1252	Empyrean Removal Tool.exe	28
PID 1252 wrote to memory of 1968	1252	Empyrean Removal Tool.exe	28
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2608	1252	Empyrean Removal Tool.exe	29
PID 1252 wrote to memory of 2624	1252	Empyrean Removal Tool.exe	30
PID 1252 wrote to memory of 2624	1252	Empyrean Removal Tool.exe	30
PID 1252 wrote to memory of 2624	1252	Empyrean Removal Tool.exe	30
PID 1252 wrote to memory of 2760	1252	Empyrean Removal Tool.exe	31
PID 1252 wrote to memory of 2760	1252	Empyrean Removal Tool.exe	31
PID 1252 wrote to memory of 2760	1252	Empyrean Removal Tool.exe	31
PID 1968 wrote to memory of 1956	1968	Part 1.exe	33
PID 1968 wrote to memory of 1956	1968	Part 1.exe	33
PID 1968 wrote to memory of 1956	1968	Part 1.exe	33
PID 1968 wrote to memory of 1976	1968	Part 1.exe	35
PID 1968 wrote to memory of 1976	1968	Part 1.exe	35
PID 1968 wrote to memory of 1976	1968	Part 1.exe	35
PID 2760 wrote to memory of 1036	2760	Part 4.exe	37
PID 2760 wrote to memory of 1036	2760	Part 4.exe	37
PID 2760 wrote to memory of 1036	2760	Part 4.exe	37
PID 2760 wrote to memory of 2364	2760	Part 4.exe	39
PID 2760 wrote to memory of 2364	2760	Part 4.exe	39
PID 2760 wrote to memory of 2364	2760	Part 4.exe	39
PID 2608 wrote to memory of 1804	2608	Part 2.exe	43
PID 2608 wrote to memory of 1804	2608	Part 2.exe	43
PID 2608 wrote to memory of 1804	2608	Part 2.exe	43
PID 2608 wrote to memory of 1804	2608	Part 2.exe	43
PID 2608 wrote to memory of 820	2608	Part 2.exe	45
PID 2608 wrote to memory of 820	2608	Part 2.exe	45
PID 2608 wrote to memory of 820	2608	Part 2.exe	45
PID 2608 wrote to memory of 820	2608	Part 2.exe	45
PID 820 wrote to memory of 2228	820	cmd.exe	47
PID 820 wrote to memory of 2228	820	cmd.exe	47
PID 820 wrote to memory of 2228	820	cmd.exe	47
PID 820 wrote to memory of 2228	820	cmd.exe	47
PID 820 wrote to memory of 944	820	cmd.exe	48
PID 820 wrote to memory of 944	820	cmd.exe	48
PID 820 wrote to memory of 944	820	cmd.exe	48
PID 820 wrote to memory of 944	820	cmd.exe	48
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 820 wrote to memory of 1636	820	cmd.exe	49
PID 1636 wrote to memory of 2092	1636	Part 2.exe	50
PID 1636 wrote to memory of 2092	1636	Part 2.exe	50
PID 1636 wrote to memory of 2092	1636	Part 2.exe	50
PID 1636 wrote to memory of 2092	1636	Part 2.exe	50
PID 1636 wrote to memory of 2832	1636	Part 2.exe	52
PID 1636 wrote to memory of 2832	1636	Part 2.exe	52
PID 1636 wrote to memory of 2832	1636	Part 2.exe	52
PID 1636 wrote to memory of 2832	1636	Part 2.exe	52
PID 2832 wrote to memory of 2056	2832	cmd.exe	54
PID 2832 wrote to memory of 2056	2832	cmd.exe	54
PID 2832 wrote to memory of 2056	2832	cmd.exe	54
PID 2832 wrote to memory of 2056	2832	cmd.exe	54
PID 2832 wrote to memory of 2844	2832	cmd.exe	55

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Empyrean Removal Tool.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Empyrean Removal Tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 1.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Part 1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\yr4iflnr7uc1.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe
      "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VG521Bu1hkqd.bat" "
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 3.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 4.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Part 4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VG521Bu1hkqd.bat

Filesize
214B

MD5
8cda934f09fa222462f567ed79650e75

SHA1
a4e98ad2eaf08648f1609eaae5627826da608b28

SHA256
0ad5175fc237982f93219f5bdc98efdbe50a8af797f52bc0dba5b15030d5580e

SHA512
a1a311e027191eb92b1ab173a1aea65353fd816f2ae66041f040ea5610c5b5eb3d677a69a67b371c06b4a0ebf1fa561488f88cd1bb1e5a2d6776077d4b079a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\yr4iflnr7uc1.bat

Filesize
214B

MD5
d256dffd26c9a5eb40456785eee8c1ee

SHA1
5224c62354c02d23dd9b407c095c5a812113be95

SHA256
259f9f832dd78be46b20477a5c4976bc55a3fd3a5404206f4a3be37b6d0f1142

SHA512
2e8226706456ccb1c5e6957e3f2fcff8563ca244276ee350110a4e175c08665f512f8db124962a92be302e78786b7479b9bf2e9b6446f5effcf78d14f44b0888

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 1.exe

Filesize
67KB

MD5
092a0c6fe885844fd74947e64e7fc11e

SHA1
bfe46f64f36f2e927d862a1a787f146ed2c01219

SHA256
91431cb73305e0f1fdc698907301b6d312a350f667c50765615672e7f10a68f2

SHA512
022589bd17b46e5486971a59b2517956bb15815266e48dc73a7ae9ac9efd42a348af09df471562eb71ffc94ce1e1845d54ca2994663d1496a385bce50ae595f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 2.exe

Filesize
409KB

MD5
e10c7425705b2bd3214fa96247ee21c4

SHA1
7603536b97ab6337fa023bafcf80579c2b4059e6

SHA256
021068ac225e479b124c33d9e7582c17fdea6e625b165b79e2c818479d8094e4

SHA512
47e031992d637fef2a67e4fb08d2d82eaba03eba6b80f3e0e0997153acf0d979d0294276c4a10a97daa50130540230865c56191e6fe8df07dbea11c50fa48a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 3.exe

Filesize
63KB

MD5
27fe9341167a34f606b800303ac54b1f

SHA1
86373d218b48361bff1c23ddd08b6ab1803a51d0

SHA256
29e13a91af9b0ac77e9b7f8b0c26e5702f46bd8aea0333ca2d191d1d09c70c5d

SHA512
05b83ad544862d9c0cfc2651b2842624cff59fc4f454e0b1a2b36a705b558fad5a834f9f1af9f2626c57f1e3cd9aa400e290eaafb6efeb680422992bcbbde5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Part 4.exe

Filesize
79KB

MD5
1f1b23752df3d29e7604ba52aea85862

SHA1
bb582c6cf022098b171c4c9c7318a51de29ebcf4

SHA256
4834d31394f19d42e8d2a035b4c3c9c36441340ea19fe766396848ecfb608960

SHA512
d52722ab73bb15d4a5b0033351f98f168192f382677e6d474f6cf506cf8dc2f5e421e45279b6cac0f074857f41a865d87b5d989450bfcb8eba925b7baa12fbde

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
cd6255064a0b4c1de4e863375fadd588

SHA1
2f69f9403df6df78463020b3811b250dff6b2d09

SHA256
3a282c0ad427489f1b19b23072df916cc4d8e19c2d0f7f636e46262b2f194492

SHA512
88c447e22ed3ce12abe64b2d508ac4af863fb8984327a055b52a8c95e92e555eade59e4aa0c367db879c05db1f4bd4bc12e78fc1503bf57ec2a5013a9b6887a9

Download Submit
memory/1252-1-0x0000000000DF0000-0x0000000000E94000-memory.dmp

Filesize
656KB

Download
memory/1252-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/1636-64-0x0000000001390000-0x00000000013FC000-memory.dmp

Filesize
432KB

Download
memory/1956-33-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/1956-32-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/1968-27-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-51-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-17-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

Filesize
96KB

Download
memory/1976-39-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1976-40-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2212-76-0x00000000001F0000-0x000000000025C000-memory.dmp

Filesize
432KB

Download
memory/2608-26-0x0000000000A40000-0x0000000000AAC000-memory.dmp

Filesize
432KB

Download
memory/2624-25-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download
memory/2760-22-0x0000000000F20000-0x0000000000F3A000-memory.dmp

Filesize
104KB

Download