asyncrat | 9618961af8c6db27588c649679634bec7ece8fabd3e48f02f33ac0b837b56d2e

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/asjdfg.exe
Size

63KB
MD5

a74bccdc0abb0d77b4b7af3a31827e17
SHA1

ed08f899146994d3e303b193a6a73b1810e4b842
SHA256

f3ff97453bf728c77ee76a946a11ab93b1c79a4f742d71fb3c2315e86007355c
SHA512

7c79c5b0c52a75db296c23db6c066da28b57f8b8749cc895af1252d9294c26fedb37404ac8f62c8ed3b0cc6e12458c6612bb6e4f78276f3fb118e7459d1c6e90
SSDEEP

1536:0YmHssdSJYUbdh98ArnX35kHqu8dpqKmY7:0YVsYYUbdAAjDGz

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

75.24.104.157:3232

Attributes

delay
3
install
true
install_file
WIndows Security Backup.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral26/files/0x000a000000023422-10.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	asjdfg.exe

Executes dropped EXE 1 IoCs

pid	Process
4288	WIndows Security Backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4520	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe
4252	asjdfg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	asjdfg.exe
Token: SeDebugPrivilege	4288	WIndows Security Backup.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 3112	4252	asjdfg.exe	85
PID 4252 wrote to memory of 3112	4252	asjdfg.exe	85
PID 4252 wrote to memory of 2000	4252	asjdfg.exe	87
PID 4252 wrote to memory of 2000	4252	asjdfg.exe	87
PID 3112 wrote to memory of 4664	3112	cmd.exe	89
PID 3112 wrote to memory of 4664	3112	cmd.exe	89
PID 2000 wrote to memory of 4520	2000	cmd.exe	90
PID 2000 wrote to memory of 4520	2000	cmd.exe	90
PID 2000 wrote to memory of 4288	2000	cmd.exe	91
PID 2000 wrote to memory of 4288	2000	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\asjdfg.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\asjdfg.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WIndows Security Backup" /tr '"C:\Users\Admin\AppData\Roaming\WIndows Security Backup.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "WIndows Security Backup" /tr '"C:\Users\Admin\AppData\Roaming\WIndows Security Backup.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC2E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4520
- - C:\Users\Admin\AppData\Roaming\WIndows Security Backup.exe
    "C:\Users\Admin\AppData\Roaming\WIndows Security Backup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAC2E.tmp.bat

Filesize
167B

MD5
35fc85dbfe0692214925afa1713e4f84

SHA1
ce9799969c7d4ff75648da03707d449e5f047c65

SHA256
cebe969f080c54130360a0f56fa1e4e45b51de62964df38747ddea0b9b0da427

SHA512
1e8eec6580d72f81ecfe25421a40944ee29142073807dda9922d6390f437166bf11c6beda281b045e99ddd82a5d7ebb4df7fdc6cc86077af64c6d8566db74794

Download Submit
C:\Users\Admin\AppData\Roaming\WIndows Security Backup.exe

Filesize
63KB

MD5
a74bccdc0abb0d77b4b7af3a31827e17

SHA1
ed08f899146994d3e303b193a6a73b1810e4b842

SHA256
f3ff97453bf728c77ee76a946a11ab93b1c79a4f742d71fb3c2315e86007355c

SHA512
7c79c5b0c52a75db296c23db6c066da28b57f8b8749cc895af1252d9294c26fedb37404ac8f62c8ed3b0cc6e12458c6612bb6e4f78276f3fb118e7459d1c6e90

Download Submit
memory/4252-1-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download
memory/4252-0-0x00007FFE51A13000-0x00007FFE51A15000-memory.dmp

Filesize
8KB

Download
memory/4252-2-0x00007FFE51A10000-0x00007FFE524D1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-7-0x00007FFE51A10000-0x00007FFE524D1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-12-0x00007FFE51A10000-0x00007FFE524D1000-memory.dmp

Filesize
10.8MB

Download