Overview

overview

10

Static

static

10

AsyncClient.exe

windows7-x64

10

AsyncClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 22:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AsyncClient.exe

  • Size

    45KB

  • MD5

    4fa92eda691f571d5c8ca313ea5ced3e

  • SHA1

    5e75ba444f13c933e19a764581d92f26496edb08

  • SHA256

    792ac08ad6bdd2f31444390d4f06be0f261ef493a3e83847e016b1292173878a

  • SHA512

    279b86f470b26f40830939d110af9826884b92e5ae68b3a36db82265e8d73d59b35b55c249aeddc0afd72af8afcf7cfd29634daeb4a22cf486f23ba40d14ef58

  • SSDEEP

    768:bukaVT3ongoWU2Gjimo2qrgKjPGaG6PIyzjbFgX3i5BOY4eEA28mIBDZZ4:bukaVT3Q+25KTkDy3bCXS6H8rdZ4

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

purIcKAdLoRB

Attributes
  • delay

    3

  • install

    true

  • install_file

    SVHOST.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
    "C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SVHOST" /tr '"C:\Users\Admin\AppData\Local\Temp\SVHOST.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "SVHOST" /tr '"C:\Users\Admin\AppData\Local\Temp\SVHOST.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE0AB.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4568
      • C:\Users\Admin\AppData\Local\Temp\SVHOST.exe
        "C:\Users\Admin\AppData\Local\Temp\SVHOST.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SVHOST.exe
    Filesize

    45KB

    MD5

    4fa92eda691f571d5c8ca313ea5ced3e

    SHA1

    5e75ba444f13c933e19a764581d92f26496edb08

    SHA256

    792ac08ad6bdd2f31444390d4f06be0f261ef493a3e83847e016b1292173878a

    SHA512

    279b86f470b26f40830939d110af9826884b92e5ae68b3a36db82265e8d73d59b35b55c249aeddc0afd72af8afcf7cfd29634daeb4a22cf486f23ba40d14ef58

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpE0AB.tmp.bat
    Filesize

    153B

    MD5

    168e7f09988c6d9ab058b268f763e87b

    SHA1

    b24836b472429ee84d7c2c1d744ef51a3cc4eec7

    SHA256

    686d8af76cad0f7bd01233390347ef10a85f570150c016e7865d4196437c0ccc

    SHA512

    ab83e17b5bf32286dc72576ca11390a937a47b32ae53bd9a17de02518fdf31662505ea3a60323250b3e6098e65ff8df2ccbd42a6fa2b106ccada148bc95e9a28

    Download Submit

  • memory/1948-0-0x00000000753DE000-0x00000000753DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1948-1-0x00000000009B0000-0x00000000009C2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1948-2-0x00000000753D0000-0x0000000075B80000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1948-3-0x0000000005410000-0x00000000054AC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1948-9-0x00000000753D0000-0x0000000075B80000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2436-13-0x00000000753D0000-0x0000000075B80000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2436-14-0x00000000753D0000-0x0000000075B80000-memory.dmp

    Filesize

    7.7MB

    Download