asyncrat | b834c4796e9073fcf3e9eccfa7034b26fc0ea94783ce111221a6b44f9e015e14

General

Target

Microsoft Update.exe
Size

163KB
MD5

39ec49dbf7fb74a21606065f713cd881
SHA1

9ddaedd9c820b2fad1534a65bed5d61611838468
SHA256

b834c4796e9073fcf3e9eccfa7034b26fc0ea94783ce111221a6b44f9e015e14
SHA512

12d24d9a79b882d4d54e42eca8673c6d78de7e6800d77ea5535deeeafa7448c0525bba767e69c1755dd36258724d7d583d121b0e9e97590925d5772f59e2f96f
SSDEEP

3072:LT3+nIM6gSYrHu9YwlIlvrg7evv3QOAQ9Be5BV0WUniyimyk:WngVik7evv3QO99Be5v0WURy

Score

10^/10

asyncrat discord discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Discord

C2

181.47.208.50:4449

Mutex

yqhbuwfankgiktwqwmr

Attributes

delay
1
install
true
install_file
Microsoft Update.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000d0000000226f6-22.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
388	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Microsoft Update.exe

Executes dropped EXE 2 IoCs

pid	Process
1528	Client.exe
1540	Microsoft Update.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3076	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
388	powershell.exe
388	powershell.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1528	Client.exe
1540	Microsoft Update.exe
1540	Microsoft Update.exe
1540	Microsoft Update.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	1528	Client.exe
Token: SeDebugPrivilege	1528	Client.exe
Token: SeDebugPrivilege	1540	Microsoft Update.exe
Token: SeDebugPrivilege	1540	Microsoft Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	Microsoft Update.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 388	2920	Microsoft Update.exe	86
PID 2920 wrote to memory of 388	2920	Microsoft Update.exe	86
PID 2920 wrote to memory of 1528	2920	Microsoft Update.exe	88
PID 2920 wrote to memory of 1528	2920	Microsoft Update.exe	88
PID 1528 wrote to memory of 5092	1528	Client.exe	89
PID 1528 wrote to memory of 5092	1528	Client.exe	89
PID 1528 wrote to memory of 432	1528	Client.exe	91
PID 1528 wrote to memory of 432	1528	Client.exe	91
PID 432 wrote to memory of 3076	432	cmd.exe	93
PID 432 wrote to memory of 3076	432	cmd.exe	93
PID 5092 wrote to memory of 4388	5092	cmd.exe	94
PID 5092 wrote to memory of 4388	5092	cmd.exe	94
PID 432 wrote to memory of 1540	432	cmd.exe	96
PID 432 wrote to memory of 1540	432	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:388
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Update" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Update" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D0A.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3076
  - - C:\Users\Admin\AppData\Roaming\Microsoft Update.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Microsoft Update.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
144KB

MD5
735308830d5d034971c6010708d8e86a

SHA1
7e6b2ad74f5b3f94c01bd0b12641a009f503fefa

SHA256
103b6e19cf47fe2f3e28f1ad2a12ddcf34287d30e0e887f9907086de379864de

SHA512
bb51f8b1166af8a827bc6559710329938b07f1663ee7fadd782f56913c51719de65b028371d64f063e970ede14b857bcddd24f7f60c56aa7899a74a338f7c3ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i53dfudg.mgo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7D0A.tmp.bat

Filesize
160B

MD5
c1adbc51cc21266bddb6e1777e5a1f60

SHA1
773475d883086ced0e5676f5131150c24e1a4dcf

SHA256
f4d2a1b89bebe294beafbe4547080632e8014d29517149201c2cbf56d81923df

SHA512
007c1986a2934c87c0755962e67f30191f0d167e7d41504bf3a1ed3a3a75aedd3282f345cc528ebaa305b9c30e77815f9fd73868f802ae5a661676f97c416dd2

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
memory/388-12-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/388-14-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/388-17-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/388-13-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/388-7-0x0000017FF2AE0000-0x0000017FF2B02000-memory.dmp

Filesize
136KB

Download
memory/1528-31-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/1540-44-0x000000001C590000-0x000000001C606000-memory.dmp

Filesize
472KB

Download
memory/1540-45-0x000000001B740000-0x000000001B750000-memory.dmp

Filesize
64KB

Download
memory/1540-46-0x000000001C530000-0x000000001C54E000-memory.dmp

Filesize
120KB

Download
memory/2920-26-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/2920-33-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

Filesize
10.8MB

Download
memory/2920-0-0x00007FF8820D3000-0x00007FF8820D5000-memory.dmp

Filesize
8KB

Download
memory/2920-1-0x0000000000A90000-0x0000000000ABE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads