asyncrat | 9618961af8c6db27588c649679634bec7ece8fabd3e48f02f33ac0b837b56d2e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/Server.exe
Size

723KB
MD5

0a7f6d5934c8ccc7dafd3e9ea31b3842
SHA1

804807e34c17429296a835e4f4f99537e7f3d7f0
SHA256

c4f054a8d630332a9d93d2447541aba2fb98ae09565ef4054bf5de94a0eb584d
SHA512

214fbb4a96de286a4db5d2645a1f0559ea4eb29a9a915c9e18e14397205d95a0eadf437c87b9c3a7336606e7ab2cf934c5e1f808b0a5b1be6b58675385603e3d
SSDEEP

12288:gaQgw7ORdYT46mb6rGERTwsKAHrY/fdTji4vSXo9ZRo9Q2AlFR9K:g1hORSE61GtZXRW4KXUEQ22zK

Score

10^/10

asyncrat quasar xworm default slave execution rat spyware trojan

Malware Config

Extracted

Family

xworm

best-bird.gl.at.ply.gg:27196

super-nearest.gl.at.ply.gg:17835

wiz.bounceme.net:6000

aes.plain

Extracted

Family

asyncrat

Botnet

Default

finally-grande.gl.at.ply.gg:25844

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

version-brings.gl.at.ply.gg:58939

Mutex

SdYxpA3nfP1H

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

stop-largely.gl.at.ply.gg:27116

Mutex

$Sxr-kl1r656AGsPQksTmi8

Attributes

encryption_key
CjDCAPF1JiLswgFipef3
install_name
$77Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Start-Up Application
subdirectory
$77

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral19/files/0x000900000002341f-6.dat	family_xworm
behavioral19/memory/1604-31-0x0000000000480000-0x000000000049A000-memory.dmp	family_xworm
behavioral19/files/0x00080000000234c4-56.dat	family_xworm
behavioral19/memory/4144-60-0x0000000000B40000-0x0000000000B5A000-memory.dmp	family_xworm
behavioral19/memory/1604-119-0x000000001C220000-0x000000001C22E000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral19/files/0x000900000002346b-39.dat	family_quasar
behavioral19/memory/3920-63-0x0000000000C60000-0x0000000000CCC000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral19/files/0x000800000002343a-17.dat	family_asyncrat
behavioral19/files/0x000800000002343b-33.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3704	powershell.exe
552	powershell.exe
4020	powershell.exe
900	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	scvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	winhlp64.exe

Executes dropped EXE 5 IoCs

pid	Process
1604	winhlp64.exe
796	mshta.exe
4380	conhost.exe
3920	Wininit.exe
4144	scvhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3704	powershell.exe
3704	powershell.exe
552	powershell.exe
552	powershell.exe
1604	winhlp64.exe
4020	powershell.exe
4020	powershell.exe
900	powershell.exe
900	powershell.exe
4144	scvhost.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	conhost.exe
Token: SeDebugPrivilege	3920	Wininit.exe
Token: SeDebugPrivilege	1604	winhlp64.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	4144	scvhost.exe
Token: SeDebugPrivilege	1604	winhlp64.exe
Token: SeDebugPrivilege	796	mshta.exe
Token: SeDebugPrivilege	796	mshta.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	4144	scvhost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1604	winhlp64.exe
4144	scvhost.exe
3920	Wininit.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1604	1628	Server.exe	85
PID 1628 wrote to memory of 1604	1628	Server.exe	85
PID 1628 wrote to memory of 796	1628	Server.exe	86
PID 1628 wrote to memory of 796	1628	Server.exe	86
PID 1628 wrote to memory of 796	1628	Server.exe	86
PID 1628 wrote to memory of 4380	1628	Server.exe	87
PID 1628 wrote to memory of 4380	1628	Server.exe	87
PID 1628 wrote to memory of 3920	1628	Server.exe	88
PID 1628 wrote to memory of 3920	1628	Server.exe	88
PID 1628 wrote to memory of 3920	1628	Server.exe	88
PID 1628 wrote to memory of 4144	1628	Server.exe	89
PID 1628 wrote to memory of 4144	1628	Server.exe	89
PID 1604 wrote to memory of 3704	1604	winhlp64.exe	91
PID 1604 wrote to memory of 3704	1604	winhlp64.exe	91
PID 1604 wrote to memory of 552	1604	winhlp64.exe	93
PID 1604 wrote to memory of 552	1604	winhlp64.exe	93
PID 3920 wrote to memory of 4764	3920	Wininit.exe	95
PID 3920 wrote to memory of 4764	3920	Wininit.exe	95
PID 3920 wrote to memory of 4764	3920	Wininit.exe	95
PID 4144 wrote to memory of 4020	4144	scvhost.exe	97
PID 4144 wrote to memory of 4020	4144	scvhost.exe	97
PID 4144 wrote to memory of 900	4144	scvhost.exe	99
PID 4144 wrote to memory of 900	4144	scvhost.exe	99

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Server.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Server.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\winhlp64.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\winhlp64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\winhlp64.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winhlp64.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\mshta.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\mshta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\conhost.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Start-Up Application" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Wininit.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- C:\Users\Admin\AppData\Local\Temp\zvgfd-main\scvhost.exe
  "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\scvhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\scvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d14ccefeb263594e60b1765e131f7a3

SHA1
4a9ebdc0dff58645406c40b7b140e1b174756721

SHA256
57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c

SHA512
2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbaarupb.tsp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Wininit.exe

Filesize
409KB

MD5
ba300d38cfdf1c73eddcd7a1ac589b78

SHA1
c8741781f775f51dbf559ae783adcd762b036946

SHA256
e35f07e7fab453e5366f8f220d8302f31dc134aebc71fedc6beb113c9706961f

SHA512
19274f0742d4e82c3f184ec264bb8f9d4fd3c7092b51ec63b727c3ab33ef70cd36805f1f7c52c663ff72496c79b827c23bfc547031f60e62dba396bdaaa50047

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\conhost.exe

Filesize
94KB

MD5
1b1bf903bf5ff355a5c36cf66730efaa

SHA1
21f23725f669365202b315b3ea735a0c7b546674

SHA256
73f3016be34137d3eea85c42b8e1b7eb2c547d431cd51d955565024feacabe28

SHA512
f2d287b0bff61cd2ac94d4de1171f71201ed10e5ba0edc9db24e83c47d4dc7d35a26e879a21f85c3088280fb2f79e838e1a2e4c7e37ef7efc3fdb5a14a167516

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\mshta.exe

Filesize
46KB

MD5
7b62d9d9393ad5328cb49036d11ecb02

SHA1
8fab4a7a3367e0eda062622e041235a470402b99

SHA256
634400b28d9ab9b31d52de167ffc07a0e28e4474cd2b9340f7858c9ce79263c7

SHA512
9dea1af61851227d6c73141df650151f23b7acbd72a45d0af942f5f8a7cb1b4dbca3b3b0e938d3ea4456f8b70900a52fa5de8254a866036070eabaf3973dc868

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\scvhost.exe

Filesize
75KB

MD5
cc64d08a2d3ef4f49bc1d8d29735f77c

SHA1
7e224bdcd235000c90c7cae9e54132669972e98f

SHA256
ee31a0c4b8fb8c9c8d0c1bdd300fe27dd4bda06d2f60e8ca6fc1f9bff6b1aaa8

SHA512
9ccc3616052ea329f19d3ffce9fb7fa1e3cb7f7fa91202646c78c50e357dc827d6237318f95b783fa8946077dc4bb60a370cfd0493cf25207f8ba612995e1c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\winhlp64.exe

Filesize
83KB

MD5
35c766c67931e9a05c1b6d30b6f3240d

SHA1
ce00d1f4a86c6cb3c6dcd960e7faa948a57a4ca0

SHA256
63e602af3958cdcee11ee572d69f99a0dad76667a3aad1c923a5cf1fc4b9b813

SHA512
bbba3f9c65e075d068a80595419d828066dac814b6ab90666a84162128cd59fc1d9aac892457217015e3c1e5de420d27fc5e9be109f7d85634eebe71fdf3da92

Download Submit
memory/796-62-0x0000000000390000-0x00000000003A2000-memory.dmp

Filesize
72KB

Download
memory/1604-69-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download
memory/1604-61-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download
memory/1604-122-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download
memory/1604-120-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download
memory/1604-119-0x000000001C220000-0x000000001C22E000-memory.dmp

Filesize
56KB

Download
memory/1604-31-0x0000000000480000-0x000000000049A000-memory.dmp

Filesize
104KB

Download
memory/1628-0-0x00007FFBFD6C3000-0x00007FFBFD6C5000-memory.dmp

Filesize
8KB

Download
memory/1628-1-0x0000000000840000-0x00000000008FC000-memory.dmp

Filesize
752KB

Download
memory/3704-70-0x00000218E7D00000-0x00000218E7D22000-memory.dmp

Filesize
136KB

Download
memory/3920-63-0x0000000000C60000-0x0000000000CCC000-memory.dmp

Filesize
432KB

Download
memory/3920-67-0x00000000056B0000-0x0000000005716000-memory.dmp

Filesize
408KB

Download
memory/3920-94-0x00000000067F0000-0x000000000682C000-memory.dmp

Filesize
240KB

Download
memory/3920-68-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/3920-118-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Filesize
40KB

Download
memory/3920-66-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/3920-65-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/4144-60-0x0000000000B40000-0x0000000000B5A000-memory.dmp

Filesize
104KB

Download
memory/4380-44-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download
memory/4380-121-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download
memory/4380-64-0x00007FFBFD6C0000-0x00007FFBFE181000-memory.dmp

Filesize
10.8MB

Download