Malware Analysis Report

2025-01-02 12:17

Sample ID 240714-g663fsscke
Target 2BB4A448B0132C70A9F3C03DB54A52F3.exe
SHA256 15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca

Threat Level: Known bad

The file 2BB4A448B0132C70A9F3C03DB54A52F3.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Async RAT payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-14 06:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-14 06:26

Reported

2024-07-14 06:28

Platform

win7-20240704-en

Max time kernel

121s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\microssofte.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\microssofte.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 2616 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2616 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2616 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2616 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2712 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2712 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2712 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2712 wrote to memory of 2708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2616 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe
PID 2616 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe
PID 2616 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe
PID 2616 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe

"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\microssofte.exe

"C:\Users\Admin\AppData\Roaming\microssofte.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 seznam.zapto.org udp
US 108.61.192.110:8808 seznam.zapto.org tcp

Files

memory/2876-0-0x000000007430E000-0x000000007430F000-memory.dmp

memory/2876-1-0x0000000000230000-0x00000000002A8000-memory.dmp

memory/2876-2-0x0000000000490000-0x00000000004A2000-memory.dmp

memory/2876-3-0x0000000074300000-0x00000000749EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp.bat

MD5 bb6c3bf2588770b5f957f1ec6c5ac1e1
SHA1 6c8b2e62bf743f9d49e2f4cf989eea0793f62288
SHA256 43013f34e03d801db6763a36bde0695852111a6c62d0db6a0ff55d939b0668e5
SHA512 6bdeb6fe4424396664e10d6a9dc8bc15104409cee180c8d6a3ee76404fdb43633f3fa5d3ffc71d3d699531195fbd0807ddf9a790de7ec7da400002e18c1f9892

memory/2876-13-0x0000000074300000-0x00000000749EE000-memory.dmp

\Users\Admin\AppData\Roaming\microssofte.exe

MD5 2bb4a448b0132c70a9f3c03db54a52f3
SHA1 2338d8ae200271ccfcf5bb8d97c8c98c52deb43c
SHA256 15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca
SHA512 5352592d1dfb6771db491a18dda53c481aee0a072d2c511959f3e2cf9532ac176a6a2f9520b22a4d4675098e089a819f1b4da89d0ec615c9458bcff1ea4cbe29

memory/1236-17-0x0000000001040000-0x00000000010B8000-memory.dmp

memory/1236-18-0x0000000000450000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabA3D0.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-14 06:26

Reported

2024-07-14 06:28

Platform

win10v2004-20240709-en

Max time kernel

94s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\microssofte.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\microssofte.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3708 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5008 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5008 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1372 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1372 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1372 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1372 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe
PID 1372 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe
PID 1372 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\microssofte.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe

"C:\Users\Admin\AppData\Local\Temp\2BB4A448B0132C70A9F3C03DB54A52F3.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB40E.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /ru system /rl highest /tn 2BB4A448B0132C70A9F3C03DB54A52F3 /tr '"C:\Users\Admin\AppData\Roaming\microssofte.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\microssofte.exe

"C:\Users\Admin\AppData\Roaming\microssofte.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 seznam.zapto.org udp
US 108.61.192.110:8808 seznam.zapto.org tcp
US 8.8.8.8:53 110.192.61.108.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 108.61.192.110:8808 seznam.zapto.org tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3708-0-0x000000007522E000-0x000000007522F000-memory.dmp

memory/3708-1-0x0000000000800000-0x0000000000878000-memory.dmp

memory/3708-2-0x0000000005860000-0x0000000005E04000-memory.dmp

memory/3708-3-0x00000000052B0000-0x0000000005342000-memory.dmp

memory/3708-4-0x00000000051E0000-0x00000000051F2000-memory.dmp

memory/3708-5-0x0000000005350000-0x00000000053EC000-memory.dmp

memory/3708-6-0x0000000075220000-0x00000000759D0000-memory.dmp

memory/3708-11-0x0000000075220000-0x00000000759D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB40E.tmp.bat

MD5 9293615ef62cba1398e4e78019bc48b8
SHA1 88a388465e72efe8c6921b55ac0a1f399c7917e8
SHA256 d92b365e505b3d92d4a7286f5a15b848b184d1c1c671227cfece0d9b00661590
SHA512 97e3268f7ce0f9f3a49b7ac48dda6974b10310d599fa237f9cae97874b6a96d1542be14670ef8c06d10162589d2a5d9f2fd8bb26a4d9b300031961a311e83899

C:\Users\Admin\AppData\Roaming\microssofte.exe

MD5 2bb4a448b0132c70a9f3c03db54a52f3
SHA1 2338d8ae200271ccfcf5bb8d97c8c98c52deb43c
SHA256 15c5c9dc7be64d7d32bf2925ce8412b3f2f212ba7c25af969d9a8ece2086a5ca
SHA512 5352592d1dfb6771db491a18dda53c481aee0a072d2c511959f3e2cf9532ac176a6a2f9520b22a4d4675098e089a819f1b4da89d0ec615c9458bcff1ea4cbe29

memory/432-16-0x0000000075220000-0x00000000759D0000-memory.dmp

memory/432-17-0x0000000075220000-0x00000000759D0000-memory.dmp

memory/432-18-0x00000000050C0000-0x0000000005126000-memory.dmp

memory/432-19-0x0000000075220000-0x00000000759D0000-memory.dmp

memory/432-20-0x0000000006810000-0x0000000006886000-memory.dmp

memory/432-21-0x0000000000800000-0x0000000000828000-memory.dmp

memory/432-22-0x0000000000AF0000-0x0000000000B0E000-memory.dmp